Verify Identity Access Container EUVD-2026-18032

The CVSS 3.1 base score of 3.1 reflects low severity: network-accessible attack vector (AV:N) with high complexity (AC:H), no privileges required (PR:N), but mandatory user interaction (UI:R) and limited impact-only integrity (I:L) with no confidentiality or availability loss (C:N, A:N). This low CVSS aligns with the phishing context; the vulnerability itself does no direct harm but enables social engineering. The AC:H component suggests the exploit path is difficult or requires specific application states. The presence of user interaction (UI:R) is critical-users must click a malicious link, reducing likelihood compared to purely automated attacks. No EPSS score, KEV status, or public exploit code is documented, indicating no confirmed active exploitation in the wild at analysis time. From an SSVC perspective, this ranks as low-priority: exploitation is not yet automatizable, requires user action, and impacts only integrity (credential theft/phishing consequence, not system compromise). Organizations using these identity platforms should prioritize patch deployment for defense-in-depth, but acute incident response is not warranted.

An attacker crafts a phishing email containing a link to a legitimate IBM Verify Identity Access login page, with the URL modified to include a redirect parameter pointing to attacker.com. A user clicks the link, logs in successfully to the IBM service, and is then transparently redirected to the attacker's site, which mimics the IBM login screen to capture re-entered credentials or steal session tokens. The AC:H rating suggests the attacker must craft the exploit under specific application configuration or state conditions, such as particular query parameter formats or disabled validation rules. No public proof-of-concept code has been identified, and the requirement for user interaction and high complexity significantly reduces feasibility compared to direct injection attacks.