IBM Security Verify Access CVE-2026-19878

Requires network access to an IBM Security Verify Access / Verify Identity Access deployment that enforces an additional authentication workflow (e.g. step-up authentication, multi-factor, or a multi-step policy flow) - that configured feature is the precondition, because the flaw bypasses the 'additional' workflow steps rather than the primary login. Per IBM's description the attacker must be a REMOTE AUTHENTICATED actor (holding valid credentials/session), which limits exploitation to insiders or attackers with stolen first-factor credentials; note the supplied CVSS vector's PR:N contradicts this and should be reconciled with IBM. Deployments that do not configure additional/step-up authentication workflows are not exposed to the bypass. Attack complexity is low (AC:L) and no user interaction is required.

This is a moderate-severity authentication workflow bypass (CVSS 6.5) in IBM's enterprise IAM access-management products. There is a direct CONFLICT between signals that must be resolved before prioritization: the CVSS vector states PR:N (no privileges required / unauthenticated), yet the IBM description explicitly says 'a remote authenticated attacker' - these cannot both be true. The description's requirement for prior authentication is the more conservative and likely-correct reading (CWE-841 improper enforcement of behavioral workflow typically presumes an actor already inside the flow), so real-world risk is lower than a PR:N vector implies; verify authentication prerequisite with IBM advisory node 7291628. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation - this is not a drop-everything emergency. However, the impact (bypassing ADDITIONAL authentication workflow steps, i.e. step-up/MFA enforcement) is security-relevant because it defeats a defensive control, and the affected products are identity gatekeepers. Net: a patch-in-normal-cycle priority, elevated for organizations that rely on IBM Verify step-up/MFA as a compensating control.

An attacker who already holds valid (likely low-privilege) credentials to an application fronted by IBM Security Verify Access authenticates, then manipulates the authentication flow so that additional required steps - such as step-up or multi-factor challenges - are skipped, gaining access at an assurance level they should not reach. No public exploit code was identified at time of analysis, and low attack complexity (AC:L) means no special timing or preconditions are needed once access to the workflow exists.