Security Verify Access CVE-2026-78399

Exploitation requires an authenticated session on the target (PR:L), after which the attacker sends a specially crafted HTTP query that triggers improper/uncontrolled resource allocation (CWE-770) against the web interface. Affected deployments are IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including the containerized editions (Security Verify Access Container and Verify Identity Access Container) per the CPE list. The key limiting factors are: valid authentication is mandatory (no unauthenticated exploitation), and impact is confined to availability - no data disclosure or modification occurs. No special non-default feature or configuration is named in the description beyond normal HTTP request handling, so default authenticated-user access to the HTTP interface is the operative prerequisite.

This is a moderate-priority availability issue, not a top-tier emergency. The CVSS 3.1 base score of 6.5 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a network-reachable, low-complexity denial of service that nonetheless requires authentication (PR:L) and yields only availability impact (A:H) with no confidentiality or integrity loss. No EPSS score, CISA KEV listing, or SSVC decision data was supplied, and there is no indication of public exploit code, so the exploitation signals are uniformly weak: there is no evidence of active exploitation and no POC identified at time of analysis. The requirement for a valid authenticated session (PR:L) meaningfully constrains the attacker population - this is not an unauthenticated internet-facing crash - which is consistent with the CWE-770 (uncontrolled resource allocation) root cause where a logged-in user sends a crafted HTTP query to exhaust system resources. Net: a credible but bounded availability risk suitable for routine prioritized patching rather than crisis response. Note the missing-data limitation explicitly: no EPSS, KEV, or POC telemetry was provided, so the 'no public exploit' determination rests on absence of input signals rather than confirmed absence of exploitation.

An attacker who already holds valid (potentially low-privilege) credentials on an IBM Security Verify Access or Verify Identity Access deployment sends one or more specially crafted HTTP queries that trigger improper allocation of system resources, exhausting memory or CPU and rendering the access-management service unavailable to legitimate users. No public exploit code was identified at time of analysis, and the network vector with low complexity (AV:N/AC:L) means a single authenticated session is sufficient to attempt the attack.