Verify Identity Access Container EUVD-2026-19986

Local access required on IBM Verify Identity Access Container/Security Verify Access Container versions 10.0-10.0.9.1 or 11.0-11.0.2, or IBM Verify Identity Access/Security Verify Access versions 10.0-10.0.9.1 or 11.0-11.0.2. No authentication required. Attacker executes malicious scripts outside normal control sphere.

This vulnerability presents elevated risk despite requiring local access (AV:L). The CVSS base score of 8.5 is driven by the scope change indicating container escape, no required privileges (PR:N), low attack complexity (AC:L), and high confidentiality impact. In containerized environments commonly used for IAM solutions, the ability to escape container boundaries represents a significant security boundary violation. However, real-world risk is moderated by the local access requirement, meaning attackers need an initial foothold on the system. No EPSS score, KEV listing, or public exploit code identified at time of analysis, suggesting this is not yet being actively targeted. For organizations running IBM Verify Access in multi-tenant environments or where local system access is possible (shared infrastructure, compromised adjacent services), this warrants urgent attention. The SSVC framework would likely classify this as medium priority given local vector but high technical impact from scope change.

An attacker who gains local access to a server running IBM Security Verify Access in a containerized environment (for example, through a compromised web application sharing the same host or via stolen SSH credentials) could exploit this vulnerability by injecting malicious scripts that the Verify Access application improperly trusts and executes. Due to the low attack complexity and no privilege requirements, the attacker achieves container escape, breaking out of the intended security boundary to access sensitive identity management data on the host system (high confidentiality impact), potentially modify IAM configurations (limited integrity impact), or disrupt authentication services (limited availability impact). The scope change indicates the impact extends beyond the vulnerable component itself to affect other system resources.