EUVD-2026-78080
GHSA-cvqh-9j59-vmc5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network request path with low complexity and no user interaction, but availability-only impact, so PR:N, AC:L and A:H with C/I:N.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
4DescriptionCVE.org
IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.
AnalysisAI
IBM Verify Identity Access (formerly IBM Security Verify Access) fails to adequately validate or bound the resources consumed by incoming requests, allowing a remote, unauthenticated attacker to drive resource exhaustion and deny service to legitimate users. Affected builds include Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, in both software and container form factors. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of IBM Verify Identity Access and Security Verify Access, as indicated by CVSS AV:N/AC:L/PR:N/UI:N, but the attack does require that the affected access manager's request-handling endpoints be network-reachable by the attacker (typically internet- or partner-facing reverse-proxy/authentication ports); instances bound only to an internal management network are not exposed to this vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base vector is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), which describes an unauthenticated network attacker who can achieve a high availability impact with no confidentiality or integrity loss and no scope change - a straightforward denial-of-service profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the vendor-supplied fixed release for your track - Verify Identity Access 11.0.3 Interim Fix 002 or later (or the 11.x build referenced in IBM support page https://www.ibm.com/support/pages/node/7286188), and Security Verify Access 10.0.9.2 Interim Fix 002 or later; container images must be repulled and redeployed, and in clustered or containerized deployments all nodes must be updated because the request handler behind a load balancer will otherwise remain reachable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Verify Access
View allIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitr
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, inclu
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security V
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauth
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today