IBM Verify Access CVE-2026-19493

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network reachability to an affected IBM Security Verify Access (10.0-10.0.9.2) or IBM Verify Identity Access (11.0-11.0.3) instance, including their container editions - exploitation is remote and unauthenticated against the shipped management/runtime interface. The limiting factor is network exposure: these appliances are often placed behind reverse proxies or on internal/DMZ segments, so instances not reachable from attacker-controlled networks are not exposed. The advisory does not name the exact vulnerable endpoint, parameter, or whether a non-default feature must be enabled, so defenders should treat any reachable instance as potentially affected until IBM's node/7291628 guidance is reviewed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely exploitable, unauthenticated, low-complexity flaw with high integrity impact (C:N/I:H/A:N), consistent with an arbitrary file write via path traversal (CWE-22). The 7.5 base score reflects integrity-only impact; however, arbitrary file write on an access-management product frequently escalates to code execution or authentication bypass, so real-world impact may exceed the raw score. No EPSS probability, KEV entry, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified from the available signals - this is currently a theoretical-but-high-potential issue rather than a confirmed active threat. The product class (identity/access gateway, often internet-facing) raises practical concern despite the absence of exploitation evidence: an unauthenticated network-reachable file-write on a security appliance is exactly the profile attackers prioritize once a POC surfaces. Patch availability from IBM makes remediation straightforward, which should drive prioritization upward for internet-exposed deployments. Key missing data: EPSS and POC status are unknown, so urgency is inferred from vector and product exposure, not from observed exploitation.

A remote, unauthenticated attacker sends a crafted request containing directory-traversal sequences to an exposed IBM Security Verify Access / Verify Identity Access endpoint, causing a file to be written outside the intended directory. By writing to a web-accessible or startup location, the attacker can plant a web shell or malicious configuration, potentially converting the file write into remote code execution on the appliance. No public exploit was identified in the provided data, and no user interaction is required per the CVSS vector.