What is the CVSS score of EUVD-2026-18066?

EUVD-2026-18066 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of IBM are affected by EUVD-2026-18066?

IBM Verify Identity Access and IBM Security Verify Access contain an authentication bypass vulnerability (CVE-2026-4101) that allows remote attackers to gain unauthorized access under high-load…. A patch is available.

How to fix or mitigate EUVD-2026-18066?

Within 24 hours: Inventory all IBM Verify Identity Access and IBM Security Verify Access deployments across versions 10.0-10.0.9.1 and 11.0-11.0.2 (both container and non-container). Within 7 days: Apply vendor-released patch to all identified instances, prioritizing production environments; test patch in staging matching production load profiles to validate under high-traffic conditions. Within 30 days: Validate patch deployment across entire infrastructure; implement load testing post-patch to confirm authentication bypass is eliminated under stress conditions; review access logs for indicators of exploit attempts during high-load periods.

IBM EUVD-2026-18066

| CVE-2026-4101 HIGH

Improper Authentication (CWE-287)

2026-04-01 ibm

GHSA-f52w-9gxq-49mc

IBM Authentication Bypass

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 21:00 euvd

EUVD-2026-18066

Analysis Generated

Apr 01, 2026 - 21:00 vuln.today

Patch released

Apr 01, 2026 - 21:00 nvd

Patch available

CVE Published

Apr 01, 2026 - 20:35 nvd

HIGH 8.1

DescriptionCVE.org

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 under certain load conditions could allow an attacker to bypass authentication mechanisms and gain unauthorized access to the application.

AnalysisAI

Authentication bypass in IBM Verify Identity Access and IBM Security Verify Access (versions 10.0-10.0.9.1 and 11.0-11.0.2, both container and non-container deployments) allows remote attackers to gain unauthorized access under specific high-load conditions without authentication. The vulnerability carries an EPSS score indicating moderate exploitation probability, with vendor patch available but no confirmed active exploitation or public proof-of-concept at time of analysis. Attack complexity is rated high (AC:H), suggesting exploitation requires specific timing or environmental conditions related to load stress.

Technical ContextAI

This vulnerability affects IBM's identity and access management (IAM) platform across multiple product lines: IBM Verify Identity Access Container (11.0-11.0.2), IBM Security Verify Access Container (10.0-10.0.9.1), and their non-containerized counterparts. The root cause is classified as CWE-287 (Improper Authentication), indicating a fundamental flaw in how the application validates user credentials or session tokens. The condition-dependent nature ('under certain load conditions') suggests a race condition, resource exhaustion scenario, or timing-based weakness in the authentication flow that becomes exploitable when the system experiences high concurrent request volumes or resource contention. IBM Verify Access serves as an enterprise access management solution handling authentication, authorization, and SSO for critical applications, making authentication bypass particularly severe.

RemediationAI

Apply vendor-released patches immediately per IBM Security Advisory at https://www.ibm.com/support/pages/node/7268253, which provides specific remediation steps and patched versions for each affected product line. Organizations should prioritize patching systems exposed to high-load conditions or external network access. As an interim mitigation while testing patches, consider implementing rate limiting, load balancing with authentication offload to less-affected systems, or restricting network access to trusted sources. Monitor authentication logs for anomalous patterns during high-load periods, including successful authentications without corresponding credential validation events. Verify patch application through version confirmation and functional testing of authentication mechanisms under load conditions.