IBM Verify Identity Access EUVD-2026-71493

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication is required and no special configuration is needed - exploitation targets a network-accessible endpoint of the IBM Verify Identity Access or Security Verify Access application in its default deployment state. IBM has not disclosed the specific endpoint, parameter, or template context involved. Exploitation is limited to confidentiality impact (C:H/I:N/A:N per IBM's assessment), meaning the template engine appears sandboxed against arbitrary command execution. The vulnerability applies equally to traditional appliance and container-based deployments. Limiting factors: the affected versions are specifically bounded (10.0.0-10.0.9.2 IF001 and 11.0.0-11.0.3 IF001), so organizations running patched or out-of-range versions are not affected.

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) positions this as high-severity unauthenticated remote information disclosure with no special conditions. The EPSS score of 0.15% at the 5th percentile indicates very low current exploitation probability, and the vulnerability is not in CISA KEV, with no public PoC identified. However, SSTI vulnerabilities are well-understood by the offensive community, and a working proof-of-concept against a specific template engine is often achievable within days of disclosure once a researcher identifies the injection point. The confidentiality-only CVSS impact (C:H/I:N/A:N) - IBM's deliberate choice to omit integrity and availability - suggests the template sandbox prevents code execution, but data readable via SSTI in an IAM system (session tokens, LDAP bind credentials, policy rules, user attributes) can directly enable lateral movement or privilege escalation in ways that raw CVSS C:H does not capture. The gap between low EPSS and high potential business impact is the key tension here: this product is a security control plane, so even read-only disclosure of its internal state is a high-consequence event.

An unauthenticated attacker sends a crafted HTTP request containing a template injection payload (e.g., a FreeMarker or Velocity expression) to a publicly accessible endpoint of the IBM Verify Identity Access portal. The server-side template engine evaluates the expression and returns internal data - such as environment variables, configuration values, or in-memory session state - in the response body. No public exploit code exists at time of analysis, but the well-documented SSTI technique class means a researcher familiar with the specific template engine could develop a working exploit relatively quickly.