EUVD-2026-57534
GHSA-vrpc-w4wp-6gg2
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Management interface exploitable over network but requires high privileges; OS command injection yields full system impact with no scope change beyond the host.
Primary rating from Vendor (us).
CVSS VectorVendor: us
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional operations by crafting a malicious HTTP request.
AnalysisAI
OS command injection in IBM Security Verify Access and IBM Verify Identity Access management interfaces enables already-privileged administrators to execute arbitrary operating system commands beyond their intended scope by submitting crafted HTTP requests to the vulnerable endpoint. Affected deployments span IBM Security Verify Access 10.0-10.0.9.2, IBM Verify Identity Access 11.0-11.0.3, and the containerized variant of the latter - covering both legacy on-premises and modern container-based identity infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold high-privileged credentials to the IBM Verify Access or IBM Verify Identity Access management interface (confirmed by PR:H in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.2 reflects network-accessible (AV:N), low-complexity (AC:L) exploitation requiring high privileges (PR:H), with full C:H/I:H/A:H impact - a pattern consistent with post-authentication privilege escalation or lateral movement rather than an initial access vector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained high-privileged management console credentials - through phishing, credential stuffing against the management interface, or insider access - crafts an HTTP request to the IBM Verify Access management endpoint, embedding OS command injection syntax within an improperly validated parameter. The server-side management application passes this unsanitized input to an OS command invocation, executing the injected payload with the privileges of the management service. … |
| Remediation | Consult the IBM official advisory at https://www.ibm.com/support/pages/node/7283079 for the patched target versions - no specific fixed version number was included in the provided intelligence data and none can be independently confirmed from available sources. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit administrative access logs on all affected IBM Security Verify Access and Verify Identity Access instances; disable or suspend non-essential administrative accounts and enforce password resets for remaining admins. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Verify Access
View allIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitr
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, inclu
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security V
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauth
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today