Verify Identity Access Container EUVD-2026-18027

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a network-accessible vulnerability requiring no authentication or user interaction, with low attack complexity and limited confidentiality impact. The CVSS score of 5.3 (medium) reflects the moderate severity. However, the practical risk is elevated by several factors: HTTP request smuggling is a well-understood attack class with reliable exploitation techniques, the vulnerability affects identity and access management systems which are high-value targets, and unauthenticated remote access is the primary attack vector. The confined impact (confidentiality only, no integrity or availability impact) and single-scope (U:U) indicate this is information disclosure rather than full system compromise. The availability of a vendor patch and non-weaponized detection opportunity suggests this should be prioritized for organizations deploying affected versions, but it does not represent a critical system-wide failure risk.

An attacker sends a crafted HTTP request with ambiguous Content-Length and Transfer-Encoding headers to a reverse proxy fronting an affected IBM Security Verify Access instance. The proxy interprets the request as a single legitimate request and forwards it, but the backend server parses it differently, allowing the attacker to inject a second request that accesses protected identity data or authentication tokens. Since the attack requires only network access (AV:N) and no authentication (PR:N), any unauthenticated attacker on the network can attempt this exploitation. No public proof-of-concept is independently confirmed, but HTTP request smuggling techniques are well-documented and reliable against misconfigured proxy-backend pairs.