Verify Identity Access Container CVE-2026-4101

Remote unauthenticated attacker exploiting IBM Verify Identity Access Container 11.0–11.0.2 or 10.0–10.0.9.1, or IBM Security Verify Access 11.0–11.0.2 or 10.0–10.0.9.1 under sustained high load conditions. Requires specific timing/load threshold to bypass authentication. No victim interaction needed.

Real-world risk is substantial despite high attack complexity. The CVSS 3.1 score of 8.1 (High) reflects network-based attack vector (AV:N) requiring no privileges (PR:N) or user interaction (UI:N), with high impact to confidentiality, integrity, and availability. However, the high attack complexity (AC:H) indicates exploitation requires precise conditions-specifically triggering the vulnerability during load stress scenarios, which may require reconnaissance or multiple attempts. No confirmed active exploitation (not present in CISA KEV) and no public proof-of-concept identified at time of analysis reduce immediate threat level. The vulnerability's severity is amplified by its presence in an authentication gateway product: successful bypass grants attackers complete unauthorized access to protected applications and resources. Organizations using these products in high-load environments (peak business hours, seasonal traffic spikes) face elevated risk. Patch availability from vendor significantly reduces risk for organizations with mature patch management programs, but the widespread version range (10.0 through 11.0.2) suggests many installations require updates.

An external attacker monitors an IBM Verify Access deployment protecting enterprise applications and identifies peak load periods (e.g., 9 AM login surge, month-end reporting cycles). During these high-load windows, the attacker sends carefully timed authentication requests exploiting race conditions or resource exhaustion in the authentication validation process. Successfully bypassing authentication mechanisms, the attacker gains unauthorized access with legitimate user privileges to protected applications, enabling data exfiltration, privilege escalation, or lateral movement across the enterprise without valid credentials. No public exploit identified at time of analysis, but the network-accessible attack vector and lack of required authentication make this attractive for targeted attacks once exploitation techniques are developed.