EUVD-2026-78890
GHSA-m8qj-7chc-3jg8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Verify Identity Access endpoint
-
DeliverySend oversized crafted request
-
ExploitTrigger out-of-bounds write overflow
-
ExecutionCorrupt memory and hijack control flow
-
ImpactExecute code or crash IAM gateway
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) over a network vector (AV:N), implying remote unauthenticated exploitation against a reachable IBM Verify Identity Access / Security Verify Access (or container) instance. However, the description does not name the specific vulnerable service, port, or request type, so the concrete trigger is unconfirmed. Limiting factors: exploitation requires network reachability to the affected component, which in hardened deployments is typically fronted by the reverse proxy and may not expose the vulnerable parser directly; affected builds are Verify Identity Access 11.0.0-11.0.3 IF001, Security Verify Access and both container editions 10.0.0-10.0.9.2 IF001, so patched or newer installs are not affected. |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes an unauthenticated, network-reachable, low-complexity memory-corruption flaw with full CIA impact - on paper a top-tier priority, especially because IBM Verify Identity Access / Security Verify Access is a network-facing access-management gateway (WebSEAL/reverse-proxy) sitting on the security perimeter, where an OOB write (CWE-787) plausibly yields remote code execution. However, the exploitation signals temper this: EPSS is only 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified - so this is 'no public exploit identified at time of analysis' rather than active exploitation. The 9.8 score reflects worst-case theoretical impact derived from a terse one-line IBM advisory that gives no exploitation detail; the low EPSS and absence of POC suggest it is not yet being exploited at scale. The key tension is that the CVSS metrics are almost certainly vendor-assigned worst-case values against an extremely sparse description ('vulnerable to a buffer overflow attack') with no reachable-endpoint, authentication-context, or preconditions specified - verify the exact affected component and whether it is exposed in a default deployment via IBM advisory node 7286188. Given the product's role as an IAM enforcement point, patch promptly despite the low EPSS. |
| Exploit ScenarioDerived | An attacker with network reach to an exposed IBM Verify Identity Access / Security Verify Access endpoint sends a crafted oversized request that overflows a buffer in the affected component, corrupting memory (CWE-787 out-of-bounds write). Per the CVSS vector this requires no authentication or user interaction and could lead to code execution or a crash of the access-management service. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
An out-of-bounds write in IBM Verify Identity Access (and its predecessor branding, IBM Security Verify Access, plus both container editions) lets an attacker reach the vulnerability over the network without credentials or user interaction, with the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating full loss of confidentiality, integrity, and availability if the memory-corruption primitive is successfully converted into code execution or a crash. Affected builds are Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001, Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, and the matching Verify Identity Access Container and Security Verify Access Container releases; patched or newer installs are not affected. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV does not list this CVE), and EPSS is low at 0.14 percent (4th percentile), so the practical near-term risk is driven by the product's position on the security perimeter rather than by observed attack activity.
RemediationAI
Patch status is: Patch available per vendor advisory - IBM has published a fix notice at https://www.ibm.com/support/pages/node/7286188 covering all four affected artifacts; because the advisory does not enumerate a fix version, treat the affected Interim Fix 001 builds as the cutoff and apply the immediately following interim fix or later release for your branch, confirming the exact build string in the IBM notice rather than assuming a version number. Upgrade Verify Identity Access to a release above 11.0.3 Interim Fix 001, Security Verify Access to a release above 10.0.9.2 Interim Fix 001, and pull the corresponding updated container images for Verify Identity Access Container and Security Verify Access Container (do not simply restart existing containers - the image tag must change). Where immediate patching is not possible, the highest-value compensating control is to reduce reachability of the vulnerable component: keep WebSEAL and all management or back-end junction interfaces behind your existing reverse proxy and firewall rules, restrict inbound access to the specific published service ports to known client networks, and remove any direct internet exposure of management endpoints - the trade-off is that this narrows legitimate access paths and may break federation or partner integrations that depend on a wider listener, so validate per integration. Additional hardening that lowers exploitability but does not remove the flaw: terminate TLS at an upstream proxy that enforces request-size and content-length limits (blunt, may reject legitimate large payloads), enable verbose request logging and memory-crash alerting on the affected instances to catch the anomalous requests an exploit would generate, and, if the deployment supports it, run the component under least-privilege accounts so a successful memory-corruption exploit lands with reduced OS privileges. Monitor IBM's advisory page for any revision, and note that no public exploit code or confirmed active exploitation of this CVE has been identified at time of analysis, so this is a scheduled-patch item rather than an emergency response - unless your deployment exposes an affected interface directly to the internet.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-787, out-of-bounds write, the memory-corruption class in which a length or index calculation is not validated before a write, so data is written past the end of an allocated buffer - typically corrupting adjacent heap metadata or a return address and opening the path to remote code execution or denial of service. CVE-2026-11928 is specific to IBM's identity and access management stack, whose CPE data covers four distinct artifacts: ibm:verify_identity_access, ibm:security_verify_access, ibm:verify_identity_access_container, and ibm:security_verify_access_container, reflecting the 10.x Security Verify Access generation, the rebranded 11.x Verify Identity Access generation, and their containerized distributions. These products include the WebSEAL reverse proxy and policy/authentication services that sit on the network edge in front of protected applications, which is why a network-reachable parsing or request-handling defect in them has an outsized blast radius. The advisory does not name the specific vulnerable service, port, or request type, so the exact trigger and the parser or protocol involved remain unconfirmed from the available data; the vendor CVSS vector nevertheless describes an unauthenticated, low-complexity, network-delivered attack, meaning the vulnerable interface must be reachable for exploitation to be possible.
Know when Verify Identity Access gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Accepting the vendor network-unauthenticated buffer-overflow framing for a network-facing IAM gateway; an OOB write plausibly yields full CIA impact, though the sparse description leaves AV/PR unverified.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
3DescriptionCVE.org
IBM Verify Identity Access is vulnerable to a buffer overflow attack.
Executive ViewAI
IBM Verify Identity Access, IBM Security Verify Access, and their container editions are affected by a critical vulnerability (CVE-2026-11928) that could allow unauthenticated, network-based attackers to fully compromise affected systems. Although no public exploit identified at time of analysis, the severity and potential for complete loss of confidentiality, integrity, and availability make immediate patching essential for organizations relying on these identity management platforms. Leadership should prioritize remediation because these systems are foundational to access control and a successful exploit could severely undermine organizational security.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Verify Identity Access
View allUnauthenticated remote code execution affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity A
Remote code execution is achievable in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 1
Hard-coded credentials in IBM Security Verify Access 10.0.0 through 10.0.9 and 11.0.0, and in Verify Identity Access Con
Authentication bypass in IBM Verify Identity Access and IBM Security Verify Access (versions 10.0-10.0.9.1 and 11.0-11.0
Local privilege escalation in IBM Security Verify Access and Verify Identity Access 10.0.x/11.0.x allows an authenticate
IBM Verify Identity Access (formerly IBM Security Verify Access) in container and appliance deployments can silently fai
Remote code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.
Arbitrary command execution in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 thro
Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0
Cross-site request forgery in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 throu
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, inclu
Security Verify Access and its Docker deployment can be induced to execute malicious scripts sourced from outside the pr
Exploit-DB