IBM Security Verify Access EUVD-2026-25135

Attacker must possess authenticated access (low-privilege user account or service credential) to the IBM Security Verify Access platform and network connectivity to affected endpoints. The vulnerability is triggered by the mere presence of data encrypted with the weaker algorithm; no special configuration or non-default settings are required. However, exploitation impact depends on what sensitive data has been encrypted and is available for decryption-for example, if authentication tokens are protected by the weak algorithm, token theft and replay become practical; if user credentials are encrypted with the weak algorithm, mass credential compromise becomes feasible. The limitation is the requirement for prior authentication; unauthenticated attackers cannot directly trigger decryption without first compromising an account or exploiting a separate authentication bypass.

This vulnerability presents moderate-to-high real-world risk despite the CVSS 6.5 score. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network-accessible exploitation requiring only low-privilege authentication with no user interaction-a realistic threat from internal or compromised accounts. Crucially, the impact is limited to confidentiality with no integrity or availability compromise, making this a data exfiltration risk rather than active system compromise. The ENISA EUVD listing confirms this is tracked as a formally disclosed vulnerability with vendor awareness. However, exploitation requires prior authentication and network access to the management plane or protected endpoints, which limits the pool of realistic attackers to insiders, compromised service accounts, or attackers who have first achieved low-privilege access. The absence of EPSS, KEV status, and public POC data suggests this is not yet subject to widespread exploitation attempts, but the cryptographic weakness is permanent and requires patching to remediate.

An internal administrator or attacker who has obtained low-privilege credentials to the IBM Security Verify Access platform authenticates to the management interface over the network. They then capture or request encrypted sensitive data (authentication tokens, user credentials, session keys) that was encrypted using the weak cryptographic algorithm. Using known cryptanalytic attacks or brute-force decryption against the insufficient key strength, they decrypt the sensitive information to compromise user accounts or escalate access across dependent systems.