IBM Verify Access EUVD-2026-57543

Exploitation requires unauthenticated network access to the IBM Verify Access or IBM Verify Identity Access reverse proxy endpoint - confirmed by the PR:N metric in the CVSS vector, meaning no credentials are needed. The High attack complexity (AC:H) is the primary limiting factor: successful exploitation is not trivially reproducible and likely requires precise construction of an ambiguous HTTP request that exploits a specific parsing inconsistency between the proxy and backend, which may be version-combination or configuration-dependent. No non-default configuration is described as a prerequisite by the vendor. Additional limiting factors include the product's typical deployment behind corporate perimeter controls, which constrains external exposure in most enterprise deployments, though internet-facing or DMZ-deployed instances would face direct risk. Authentication requirements are explicitly absent per the PR:N CVSS metric.

The vendor-assigned CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-exploitable, unauthenticated flaw that carries full C/I/A impact but is tempered by High attack complexity (AC:H). The AC:H rating is credible for HTTP request smuggling, which requires precise crafting and may depend on specific proxy-backend version combinations. Scope Unchanged (S:U) may understate strategic risk: as an identity gateway, authentication bypass does not merely expose one resource but may propagate trust failures to any system relying on the gateway's access decisions. No EPSS data was supplied, no CISA KEV listing exists, and no POC has been identified - exploitation is unconfirmed and likely requires non-trivial technical capability at this time. However, the sensitivity of the target class (IAM gateways are high-value for lateral movement) warrants prioritized patching over EPSS-based deferral. There is no data conflict in the available signals, though the description says 'access sensitive information' while the tag indicates full authentication bypass - the latter is the more accurate characterization supported by I:H and A:H in the CVSS vector.

An unauthenticated remote attacker sends a precisely crafted HTTP request to the IBM Verify Access reverse proxy, exploiting the parsing inconsistency between the proxy and the backend authentication service to have the proxy forward the request with authentication checks bypassed. The attacker then accesses protected administrative interfaces or identity data without valid credentials. No public proof-of-concept has been identified, but the HTTP desync technique class is well-documented in open security research and tooling.