EUVD-2026-95269
GHSA-whg2-2h76-8mr5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states remote unauthenticated code execution via untrusted deserialization, giving AV:N/AC:L/PR:N/UI:N and full C/I/A impact on the host (S:U).
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
AnalysisAI
Remote code execution is achievable in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, because the affected services deserialize untrusted data received over the network. The flaw is reachable without authentication and without user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), allowing an attacker who can reach the vulnerable endpoint to run arbitrary code with the privileges of the affected process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The flaw is reached whenever an affected IBM Security Verify Access (10.0 through 10.0.9.2) or IBM Verify Identity Access (11.0 through 11.0.3) instance - including the container editions - exposes the vulnerable service that deserializes attacker-supplied data to the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status: Patch available per vendor advisory - IBM has published remediation for both affected product lines at https://www.ibm.com/support/pages/node/7291628, which lists the fixed releases and any interim fixes for Security Verify Access 10.x and Verify Identity Access 11.x, including their container editions; apply the current fix level for your branch rather than the specific versions quoted in this CVE description, and rebuild container images from the patched base so the fix is not lost on redeploy. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every deployment of IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including all container editions and derived images, and restrict network reachability of the affected service so that only trusted management hosts and required clients can connect - prioritizing any internet-facing or partner-exposed instances - while enabling detailed logging to detect anomalous deserialization traffic. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Verify Access
View allIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
An out-of-bounds write in IBM Verify Identity Access (and its predecessor branding, IBM Security Verify Access, plus bot
Unauthenticated remote code execution affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity A
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client
IBM Verify Identity Access (formerly IBM Security Verify Access) in container and appliance deployments can silently fai
Authentication bypass in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11
Arbitrary code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access
Authentication bypass in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11
Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today