IBM Security Verify Access CVE-2026-19494

Exploitation requires the attacker to already be a remote AUTHENTICATED user of IBM Security Verify Access (10.0 through 10.0.9.2) or IBM Verify Identity Access (11.0 through 11.0.3), including their container variants (per CVSS PR:L) - unauthenticated anonymous attackers cannot trigger it. Given a valid low-privilege session, no user interaction and no elevated privileges are needed and attack complexity is low (AC:L), so the bypass is reliably reproducible once credentials are held. The limiting factors are therefore: (1) possession of valid low-level credentials/session, and (2) running an affected, unpatched version; the provided description does not specify whether a non-default feature or configuration mode is required, so that condition should be confirmed against IBM advisory node/7291628.

This is a credible, above-average-priority issue but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable flaw of low attack complexity requiring only low-level authentication, with high confidentiality and integrity impact and no availability impact - consistent with an authentication-bypass that lets an already-authenticated low-privilege user cross security boundaries (CWE-287). The 8.1 base score is driven by the C:H/I:H impact rather than by trivial access, since PR:L means the attacker must first hold valid (even if limited) credentials or a session on the product. No EPSS probability, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or mass-scanning at this time - the status is best characterized as a vendor-reported flaw with a patch available. Because the affected products (IBM Security Verify Access / Verify Identity Access) are themselves identity and access-management gateways, a bypass here is strategically valuable even without wormable mechanics, so it warrants prompt patching in environments that run these appliances, while recognizing the authenticated prerequisite meaningfully narrows the opportunistic threat surface. Note: the description does not name the specific authentication mechanism bypassed - the exact precondition should be verified against the IBM advisory (node/7291628).

An attacker who already holds valid low-privilege credentials or an authenticated session to an IBM Security Verify Access / Verify Identity Access deployment sends crafted requests that exploit the improper authentication logic to bypass security restrictions. This grants them access to resources or operations they should not be authorized for, disclosing sensitive data and allowing unauthorized modification (C:H/I:H). No public exploit code was identified in the provided intelligence, and low attack complexity (AC:L) means the technique is reliable once the precondition is met.