IBM Verify Directory CVE-2026-8642

Exploitation requires reaching the product's debug endpoints over the network and the low-privilege authentication indicated by PR:L in the CVSS vector; it is not fully unauthenticated. The flaw is in IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0, where these debug endpoints disclose server versions and session identifiers. Impact is limited to information disclosure (C:L, no integrity or availability effect), so the practical risk is reconnaissance and version fingerprinting rather than direct compromise; the available sources do not state whether the debug endpoints are enabled by default or require a specific configuration, so that limiting factor is unverified.

This is a low-severity information disclosure issue (CVSS 4.3) and the signals are internally consistent: the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates a network-reachable, low-complexity flaw that requires some level of authentication (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability effect. No EPSS score was supplied, the CVE is not in CISA KEV, and no exploit or PoC reference is present, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today Decision label is 'this_month', consistent with a patch-when-scheduled priority rather than an emergency. The practical value to an attacker is reconnaissance: disclosed server versions and session identifiers aid fingerprinting of vulnerable builds and could, if session identifiers are usable, assist session-related attacks - but the CVE itself scopes impact to information disclosure only. No key signals conflict; the main missing data points are EPSS probability and any independent confirmation of exploitation.

A low-privileged authenticated user (or an attacker who has already obtained limited access) queries the exposed debug endpoints of IBM Security Verify Directory and reads back system information such as server version strings and session identifiers. The attacker uses the disclosed version to confirm the deployment is a vulnerable build and to plan follow-on attacks; the leaked session identifiers may further aid targeting. No public exploit code is identified at time of analysis, and exploitation is low-complexity but requires the authentication level indicated by PR:L.