IBM Verify Directory EUVD-2026-119734

Exploitation requires the attacker to fix or obtain a session identifier for the IBM (Security) Verify Directory management console and then have the victim authenticate to that same session; the attack only yields access after the victim completes authentication, so it hinges on victim interaction and on the console not regenerating the session identifier at login. The supplied CVSS vector states PR:L (authenticated attacker) and UI:N (no interaction), but the described session-fixation mechanism inherently depends on victim authentication, so the practical limiting factor is the need to deliver the fixed session to an administrator and have them log in - the precise trigger and whether any attacker authentication is required are not fully described in the available sources. Affected only on Security Verify Directory 10.0.0-10.0.4 and Verify Directory 11.0.0; the vendor patch is the stated remediation.

The input CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw with high impact to confidentiality, integrity and availability of the directory management console. One signal is internally inconsistent and should be flagged: the vector specifies UI:N (no user interaction), yet the description states the victim must authenticate for the attacker to hijack the session - classic session fixation (CWE-384) inherently depends on victim action, which normally maps to UI:R. Likewise PR:L (authenticated attacker) is questionable for session fixation, where the attacker typically needs no account and only supplies/fixes a session identifier. No EPSS score, no CISA KEV listing and no PoC reference are present in the input, so there is no evidence of active or imminent exploitation; the only exploitation-relevant signals are the high CVSS and the vendor's own 'this_week' priority label. Net assessment: a genuinely serious authentication/session-management weakness in an identity product (compromise of a directory console is high value), but currently a patch-promptly issue rather than an emergency - treat it as elevated priority driven by impact, not by observed exploitation. Verify the UI and PR metrics with IBM, as the vector and description conflict.

An attacker obtains or plants a session identifier for the IBM Verify Directory management console and induces the victim administrator to authenticate within that attacker-known session (session fixation). Once the victim logs in, the attacker reuses the now-authenticated session identifier to access the directory management console with the victim's privileges. No public exploit code or PoC reference is provided in the available sources.