IBM Security Verify CVE-2026-8861

No special conditions required per CVSS vector AV:N/AC:L/PR:N/UI:N - remote unauthenticated exploitation against default configurations of IBM Security Verify Access and IBM Verify Identity Access products. Exploitation is limited to information disclosure (C:L); an attacker cannot directly modify data or cause service disruption through this vulnerability alone. Meaningful exploitation requires the IBM Security Verify web interface to be reachable from the attacker's network position; deployments fully isolated behind strict firewall controls reduce exposure. The container variants are equally affected, so containerized deployments in Kubernetes or OpenShift environments with exposed ingress are within scope.

The CVSS 3.1 base score of 5.3 Medium, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicates unauthenticated, low-complexity, network-accessible exploitation with limited confidentiality impact only. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. No KEV listing and no public POC exist at time of analysis, meaning this is not a confirmed actively exploited vulnerability. Real-world prioritization should be moderate: the vulnerability alone does not yield direct unauthorized access, data exfiltration, or service disruption, but it functions as a force-multiplier for follow-on attacks by reducing attacker reconnaissance effort. In hardened or internet-facing IAM deployments, leaking internal error details is a meaningful risk. Organizations with non-public, firewall-restricted deployments face lower immediate risk but should still patch given the vendor fix is available.

An unauthenticated remote attacker sends a malformed or boundary-case HTTP request to an IBM Security Verify web endpoint, intentionally triggering an application error. The server returns a detailed technical error message containing internal system details - such as software version, internal file paths, or stack trace fragments - directly in the browser response. The attacker uses this information to refine a targeted follow-on exploit against the identified software version or exposed configuration.