Verify Identity Access EUVD-2026-104674

Exploitation requires the attacker to be in adjacent-network or physical proximity to the appliance (per the AV:A vector and IBM's 'physically proximate' wording - these disagree and should be verified) and to use credentials hard-coded into IBM Verify Identity Access 11.0.3.1 or IBM Security Verify Access 10.0.9.3. No authentication is required beyond the embedded credentials and no user interaction is needed (PR:N/UI:N). The principal limiting factor is lack of remote/internet reachability: an attacker cannot exploit this from an arbitrary remote network, which materially reduces exposure for appliances deployed on segmented or physically restricted management networks. Only the specified appliance versions are affected.

This is a serious but access-constrained flaw. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes low-complexity exploitation requiring no privileges or user interaction and yielding full confidentiality, integrity and availability impact - consistent with CWE-798 hard-coded credentials that act as an always-valid backdoor. The critical limiter is the attack vector: the CVSS encodes AV:A (adjacent network), yet the IBM description states a 'physically proximate attacker,' which maps more naturally to AV:P (physical). This is a direct conflict between two authoritative signals and should be verified with IBM - if the true vector is physical, real-world risk drops substantially versus an adjacent-network reading. No exploitation-probability or exploitation-status signals are available: there is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no public exploit identified at time of analysis. Net: the high base score reflects impact and ease once an attacker is in position, but the physical/adjacent access requirement makes this a lower real-world priority than a remotely exploitable 8.8 - patch on normal cycles unless the appliances sit in low-trust physical/network zones.

An attacker with adjacent-network or physical proximity to an affected IBM Verify Identity Access 11.0.3.1 or IBM Security Verify Access 10.0.9.3 appliance connects to a management or service interface and authenticates using credentials hard-coded into the product, obtaining elevated privileges on the device. No prior account or user interaction is needed, and attack complexity is low. No public exploit code is identified at time of analysis.