Verify Identity Access Container EUVD-2026-18033

The CVSS 5.3 score reflects a network-reachable, unauthenticated vulnerability with low attack complexity and low confidentiality impact but no integrity or availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated access requiring no user interaction. HTTP request smuggling is a well-understood attack class with reproducible proof-of-concept techniques across many proxy and backend combinations. While the confidentiality impact is rated 'Low' in CVSS (partial unauthorized information access rather than full system compromise), the real-world risk is moderate to significant because identity and access management systems contain sensitive authentication credentials, user identity data, and access control policies. The fact that this affects multiple major versions (10.x and 11.x across multiple product lines) and that a vendor patch exists suggest this was discovered and addressed proactively rather than exploited at scale. The lack of active exploitation confirmation and moderate CVSS suggest this should be prioritized as a medium-risk patch within a standard vulnerability management cycle, not a critical emergency.

An unauthenticated attacker on the network crafts a malformed HTTP request that exploits differences in how the reverse proxy and the backend IBM Verify Identity Access application parse the request headers. For example, by manipulating Content-Length and Transfer-Encoding fields, the attacker tricks the proxy into treating the request as legitimate and forwarding it, while the backend processes an injected second request that bypasses access controls. The attacker extracts sensitive identity data, authentication tokens, or policy configurations that would normally require authentication, leading to unauthorized information disclosure and potential lateral movement or privilege escalation in downstream systems.