Verify Identity Access Container EUVD-2026-18067

CVSS 5.4 (Low-to-Medium) reflects network-accessible attack vector with low complexity, but authentication requirement (PR:L) and user interaction requirement (UI:R) substantially limit real-world impact. EPSS data not provided, but exploitation probability is moderate given that Content-Type misconfigurations are common and well-understood attack surface. No CISA KEV confirmation or public POC identified in provided data, suggesting active exploitation is not confirmed. The combination of authentication + UI requirement + limited blast radius (session-scoped XSS) means this is a lower-priority fix compared to unauthenticated or network-without-auth vulnerabilities, though it still poses risk in environments where certificate listing is accessed by privileged users or federated identity scenarios. Risk assessment: moderate priority for patching, particularly in environments handling sensitive identity data.

An authenticated user with access to the IBM Verify Identity Access certificate listing interface is redirected or socially engineered to click a malicious link injecting JavaScript into the certificate list response. Because the response is labeled as text/html despite containing JSON, the browser executes embedded JavaScript in the user's security context, allowing an attacker to steal session cookies, modify certificate trust settings, or perform actions on behalf of the authenticated user. Exploitation requires both authentication and user interaction (clicking a link or visiting an attacker-controlled page), reducing opportunistic exploitation likelihood.