EUVD-2026-95270
GHSA-fprc-8q8x-4996
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Deserialization of untrusted data by a remote unauthenticated attacker over the network with no interaction (AV:N/AC:L/PR:N/UI:N) yielding full code execution, so C/I/A all High.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
AnalysisAI
Unauthenticated remote code execution affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 - including their containerized editions - through deserialization of untrusted data, allowing an attacker who can reach the affected service to run arbitrary code on the system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms the flaw is network-reachable and requires no authentication, privileges, or user interaction, so any exposed, unpatched instance should be considered directly exploitable; the only real gating factors are running an affected build and whether the vulnerable endpoint is network-accessible. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the affected IBM Security Verify Access (10.0 through 10.0.9.2) or IBM Verify Identity Access (11.0 through 11.0.3) service, including the containerized variants, that processes the untrusted serialized data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: available per vendor advisory (IBM has published a fix for this issue; the exact remediated build string is not enumerated in the data provided, so obtain the specific fixed version from IBM's advisory at https://www.ibm.com/support/pages/node/7291628), applying it to IBM Security Verify Access 10.0 through 10.0.9.2, IBM Verify Identity Access 11.0 through 11.0.3, and the Security Verify Access Container and Verify Identity Access Container images, then rebuilding and redeploying affected containers rather than only updating the running instance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every deployment of IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including all containerized editions and replica/standby nodes, and determine which instances are reachable from untrusted networks; restrict network access to the affected management and service endpoints at the load balancer, reverse proxy, or firewall to only trusted administrative ranges as an immediate containment step, and prioritize internet-facing or partner-facing instances for first-wave remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Verify Access
View allIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
An out-of-bounds write in IBM Verify Identity Access (and its predecessor branding, IBM Security Verify Access, plus bot
Remote code execution is achievable in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 1
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client
IBM Verify Identity Access (formerly IBM Security Verify Access) in container and appliance deployments can silently fai
Authentication bypass in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11
Arbitrary code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access
Authentication bypass in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11
Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today