IBM Verify Directory CVE-2026-8640

Exploitation requires the targeted user to be actively authenticated to IBM Security Verify Directory (10.0.0-10.0.4) or IBM Verify Directory (11.0.0) and to be tricked into interacting with attacker-controlled content (UI:R) while that session is live. The enabling defect is the absence of the SameSite attribute on session cookies, which lets the browser attach them to cross-site requests. Limiting factors: impact is confined to Low integrity (no data disclosure or outage), the victim must hold a valid session and perform the triggering interaction, and modern browsers that default cookies to SameSite=Lax provide partial mitigation for top-level cross-site navigations, narrowing realistic exploitation.

This is a genuinely low-priority issue despite being network-reachable. The CVSS 3.1 base score of 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) reflects a CSRF weakness (CWE-352) caused by missing SameSite attributes on session cookies - it has no confidentiality or availability impact and only Low integrity impact, and it requires user interaction (UI:R) by an authenticated victim. No EPSS score, CISA KEV listing, or public PoC/exploit reference is present in the supplied data, so there is no signal of active or imminent exploitation; the vendor-assigned vuln.today Decision label is 'monitor', which is consistent with all other signals pointing to low urgency. One signal to verify: the input vector uses PR:L, but classic CSRF generally scores PR:N because the attacker holds no account and instead abuses an already-authenticated victim's browser session - this does not raise real-world severity materially but is noted below. Overall this is a low-real-risk, defense-in-depth hardening fix rather than a priority emergency.

An attacker lures an already-authenticated Security Verify Directory user into visiting a malicious web page, which silently submits a forged state-changing request; because the session cookie lacks a SameSite attribute, the browser attaches it and the application processes the request as the victim. No public exploit identified at time of analysis, and realistic impact is limited to the Low-integrity actions the victim's session can perform.