Verify Identity Access Container EUVD-2026-19998

Remote unauthenticated attacker can exploit IBM Verify Identity Access Container 11.0-11.0.2, IBM Security Verify Access Container 10.0-10.0.9.1, or corresponding non-container versions. Requires network access to internal authentication endpoints protected by Reverse Proxy. No victim interaction needed.

Real-world risk assessment reveals moderate priority despite the CVSS 7.2 High rating. The CVSS vector shows favorable attacker conditions: network-accessible (AV:N), low attack complexity (AC:L), no authentication required (PR:N), and no user interaction needed (UI:N). However, the impact is constrained to Low confidentiality and integrity with no availability impact (C:L/I:L/A:N), suggesting limited exploitation consequences even when successful. The Changed scope (S:C) elevates severity by indicating cross-boundary impact, but without EPSS probability data, CISA KEV inclusion, or public proof-of-concept code, there are no confirmed indicators of active threat actor interest. The SSRF nature means exploitation requires attacker knowledge of internal endpoint topology and authentication mechanisms to achieve meaningful impact beyond basic service enumeration. Organizations using these IBM products in environments where the reverse proxy is the primary security control for internal authentication services face elevated risk, while defense-in-depth deployments with additional network segmentation and endpoint authentication provide risk mitigation. This represents a real architectural flaw requiring remediation, but lacks the urgent exploitation signals that would prioritize it above vulnerabilities with confirmed active exploitation or readily available weaponization.

An unauthenticated remote attacker identifies an internet-facing IBM Security Verify Access reverse proxy endpoint and crafts malicious HTTP requests with manipulated headers or URL parameters to exploit the SSRF vulnerability. By bypassing reverse proxy protections, the attacker gains direct communication with internal authentication endpoints that should be isolated from external networks. The attacker enumerates internal authentication services, potentially retrieving configuration details, valid authentication endpoints, or session management information (low confidentiality impact). With knowledge of internal API structures, the attacker may attempt to manipulate authentication flows or inject malicious data into internal authentication requests (low integrity impact), potentially creating unauthorized access paths or poisoning authentication caches. No public exploit code exists at time of analysis, but the low attack complexity and network accessibility make this vulnerability practical to exploit once internal endpoint architecture is understood through reconnaissance.