EUVD-2026-78884
GHSA-4p6j-6xj2-m6q8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain restricted admin/operator access
-
ExploitCraft request bypassing entitlement validation
-
ExecutionServer executes unentitled command
-
ImpactEscalate control over appliance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate name authentication
|
| Exploitation Conditions | Requires access to the IBM Verify Identity Access / Security Verify Access administrative/management interface as an administrator whose role is not entitled to the targeted commands; exploitation is via improperly validated user-supplied management requests. Limiting factors: the description scopes the actor to 'an administrator,' implying prior authenticated admin access (contradicting the vendor PR:N); the vendor's AC:H indicates a specially crafted request is needed to defeat validation; affects appliance and container editions at or below 11.0.3 IF001 (VIA line) and 10.0.9.2 IF001 (SVA line). No user interaction is required and the fix is available from IBM. |
| Impact | The vendor CVSS of 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this High, but the signals conflict internally. The description explicitly says 'an administrator' can execute additional commands they are not entitled to - i.e. the actor is already an authenticated (privileged) admin performing privilege escalation - yet the vendor vector encodes PR:N (unauthenticated). This is a material discrepancy: PR:N should be verified with IBM, as the description implies at least PR:L. The AC:H rating tempers the score, indicating a non-trivial precondition (crafted/malformed request that defeats validation). Supporting signals point to LOW real-world urgency despite the High base score: EPSS is 0.14% (4th percentile), the CVE is NOT in CISA KEV, and no public POC is identified. There is no SSVC data provided. Net: no public exploit identified at time of analysis, and the flaw is an admin-to-admin privilege/command escalation on an IAM appliance rather than a mass-exploitable pre-auth RCE. Real priority is moderate - patch on normal enterprise cadence, prioritized higher for internet-exposed or multi-tenant/multi-admin deployments where a lower-privileged operator could escalate. |
| Exploit ScenarioDerived | A lower-privileged administrator (or an attacker who has compromised a restricted admin account) on an IBM Verify Identity Access / Security Verify Access appliance submits a crafted management request that the server fails to validate correctly, causing it to execute commands the account is not authorized to run. No public exploit code is identified, and the vendor's AC:H rating indicates the request must be specifically crafted to bypass the validation logic. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
IBM Verify Identity Access and its container edition (versions 11.0.0 through 11.0.3 Interim Fix 001), along with the legacy Security Verify Access and container edition (10.0.0 through 10.0.9.2 Interim Fix 001), fail to properly validate user-supplied management requests, so an administrator whose role is not entitled to certain commands can execute them anyway. The vendor scores this High at CVSS 8.1, but exploitation requires prior access to the administrative/management interface as a role-restricted administrator and a specially crafted request capable of defeating the validation logic, and no public exploit identified at time of analysis (EPSS 0.14%, 4th percentile) exists, while a vendor fix is available.
RemediationAI
Patch available per vendor advisory: IBM has released fixes documented at https://www.ibm.com/support/pages/node/7286188, and the affected ranges terminate at 11.0.3 Interim Fix 001 for the Verify Identity Access line (appliance and container) and 10.0.9.2 Interim Fix 001 for the Security Verify Access line (appliance and container), so upgrade to the interim fix published on that page for the corresponding product line and edition rather than the listed baseline. Until upgrades are complete, the most effective compensating control is to attack the prerequisite: because exploitation requires an administrator role that lacks entitlement to the targeted commands, audit every administrative account on the management interface, remove or downgrade unnecessary admin privileges, and segregate highly privileged management roles so that a single restricted admin cannot reach the vulnerable command paths; the trade-off is that tightening role assignment can break delegated administration workflows and requires coordination with identity teams. Additionally, restrict reachability of the administrative/management interface to trusted management networks, jump hosts, or VPN ranges via network ACLs/firewall rules (side effect: legitimate remote administration must be funneled through those paths), and enable and monitor management-plane audit logging with alerting on command execution or privilege escalation by accounts exceeding their assigned role. Neither workaround eliminates the underlying validation defect, so scheduling the vendor fix remains the definitive remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is mapped to CWE-289 (Authentication Bypass by Alternate Name), the class of weakness in which a product enforces entitlement or authorization based on the name/identifier of a requested resource but fails to check all equivalent names or aliases for that resource. Here the affected component is the administrative/management plane of IBM Verify Identity Access (formerly IBM Security Verify Access) and its container edition, where management requests carrying command or resource identifiers are validated insufficiently, allowing an alternate or non-canonical representation of a command to slip past role/entitlement mapping and be executed by an administrator who is not authorized for it. Because the impact vector is C:H/I:H/A:H, successful abuse grants full read/write/destructive capability within that administrative context rather than only information exposure, even though the associated tags include Information Disclosure. Note the signal conflict in the scoring: IBM's published vector uses AV:N/AC:H/PR:N/UI:N, implying unauthenticated, hard-to-craft network exploitation, whereas the independent assessment scores AV:N/AC:L/PR:L/UI:N, reflecting the description's explicit scoping of the actor to 'an administrator' (authenticated, role-restricted access to the management interface) with a lower attack-complexity estimate for the specially crafted request; the CVSS v3.1/S:U scope and C:H/I:H/A:H impact are common to both. The container CPEs confirm the flaw ships in both the appliance/machine-image distribution and the containerized distribution of the same product line.
Know when Verify Identity Access gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description scopes the actor to an administrator, so PR:L not PR:N; a request-validation flaw enabling command execution gives full C/I/A over the appliance.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
3DescriptionCVE.org
IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.
Executive ViewAI
IBM Verify Identity Access and the legacy Security Verify Access product line - both standard and container editions, across versions 11.0.0 through 11.0.3 Interim Fix 001 and 10.0.0 through 10.0.9.2 Interim Fix 001 - contain a management-interface validation flaw that lets a role-restricted administrator execute commands their assigned role should not permit. The exposure is limited to organizations running these IAM platforms and requires an attacker to already hold administrative access to the management console, so the practical risk is insider abuse or escalation from a compromised admin credential rather than broad external attack. Because these systems are the authentication and access-control backbone for the enterprise, leadership should treat unauthorized command execution there as a potential weakening of the controls protecting every downstream application, even though no public exploit code is currently identified.
Apply vendor patch. Until it is deployed, restrict management-interface access to trusted networks and administrative jump hosts, enforce least privilege and segregation of duties across administrative roles, and monitor audit logs for commands executed outside a role's entitlement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Verify Identity Access
View allUnauthenticated remote code execution affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity A
Remote code execution is achievable in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 1
Hard-coded credentials in IBM Security Verify Access 10.0.0 through 10.0.9 and 11.0.0, and in Verify Identity Access Con
An out-of-bounds write in IBM Verify Identity Access (and its predecessor branding, IBM Security Verify Access, plus bot
Authentication bypass in IBM Verify Identity Access and IBM Security Verify Access (versions 10.0-10.0.9.1 and 11.0-11.0
Local privilege escalation in IBM Security Verify Access and Verify Identity Access 10.0.x/11.0.x allows an authenticate
IBM Verify Identity Access (formerly IBM Security Verify Access) in container and appliance deployments can silently fai
Remote code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.
Arbitrary command execution in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 thro
Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0
Cross-site request forgery in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 throu
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, inclu
Exploit-DB