What is the CVSS score of CVE-2026-2862?

CVE-2026-2862 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-2862?

Yes, a patch is available for CVE-2026-2862. Update the affected software to the latest version immediately.

IBM CVE-2026-2862

EUVD-2026-18033 MEDIUM

HTTP Request/Response Smuggling (CWE-444)

2026-04-01 ibm

IBM Information Disclosure Request Smuggling

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 21:15 euvd

EUVD-2026-18033

Analysis Generated

Apr 01, 2026 - 21:15 vuln.today

Patch released

Apr 01, 2026 - 21:15 nvd

Patch available

CVE Published

Apr 01, 2026 - 20:41 nvd

MEDIUM 5.3

DescriptionCVE.org

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 IBM Security Verify could allow a remote attacker to access sensitive information due to an inconsistent interpretation of an HTTP request by a reverse proxy.

AnalysisAI

Remote attackers can access sensitive information in IBM Verify Identity Access Container 11.0-11.0.2, IBM Security Verify Access Container 10.0-10.0.9.1, and their non-containerized counterparts through HTTP request smuggling. The vulnerability exploits inconsistent HTTP request interpretation between the application and its reverse proxy, allowing unauthenticated remote access to restricted data with low attack complexity.

Technical ContextAI

This vulnerability (CWE-444: Inconsistent Interpretation of HTTP Requests) occurs in HTTP request smuggling attack vectors where a reverse proxy and backend application parse HTTP requests differently. Attackers leverage ambiguities in request formatting-such as conflicting Content-Length and Transfer-Encoding headers, or other HTTP protocol variations-to inject requests that the proxy forwards legitimately but the backend interprets as a separate, unintended request. IBM Verify Identity Access and IBM Security Verify Access products, both identity and access management platforms, are affected in their containerized (11.0-11.0.2 and 10.0-10.0.9.1) and non-containerized (11.0-11.0.2 and 10.0-10.0.9.1) deployment models. The network-accessible proxy interface becomes the ingress point for this interpretation discrepancy.

RemediationAI

Apply the vendor-released security patch available from IBM for the affected product line and version. For IBM Verify Identity Access and IBM Security Verify Access Container users running 11.0-11.0.2, upgrade to the patched 11.0.x version specified in the IBM advisory. For users on 10.0-10.0.9.1, upgrade to a patched version of 10.0.x or migrate to 11.0 (patched) as appropriate for your deployment schedule. Interim mitigation includes reviewing reverse proxy configurations to ensure consistent HTTP request parsing rules and implementing strict validation of Content-Length and Transfer-Encoding headers at the proxy layer. Consult https://www.ibm.com/support/pages/node/7268253 for exact patched version numbers, deployment-specific guidance, and validation steps.