Security Verify Access EUVD-2026-95271

Exploitation requires an active, authenticated session to the IBM Security Verify Access / Verify Identity Access web/management interface AND user interaction (UI:R): a logged-in user - most impactfully an administrator - must be tricked into loading attacker-controlled web content (malicious link, email, or page) while that session is valid. The attacker needs no credentials of their own (PR:N) and no special appliance configuration is named in the description; the limiting factors are the need for a concurrently authenticated victim, the social-engineering/user-interaction step, and network reachability of the targeted management endpoint (highest risk where that interface is internet-exposed). The high impact presumes the forged request targets privileged state-changing actions.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates this CSRF (CWE-352) as High, but several signals temper the real-world urgency. No EPSS score, no KEV listing, and no public POC were provided in the input, so by precision rules this is 'no public exploit identified at time of analysis' - there is no evidence of active or automated exploitation. The CVSS vector's PR:N reflects that the ATTACKER needs no credentials, but the UI:R requirement plus the inherent nature of CSRF means success depends entirely on luring an already-authenticated administrator/user of the appliance into visiting a malicious page while their session is live - a meaningful real-world limiter. The C:H/I:H/A:H impacts appear to assume the forged request triggers high-privilege administrative actions; the terse description ('malicious and unauthorized actions') does not itself confirm full CIA compromise, so these impact ratings are vendor-assigned and should be treated as the worst case rather than verified fact. Net: this is a genuine, patch-worthy flaw in an enterprise IAM product, but it is a user-interaction-gated CSRF with no exploitation evidence - prioritize patching of internet-exposed management interfaces, but it is not an emergency on the level of an unauthenticated RCE.

An attacker crafts a web page or email containing a hidden, auto-submitting form (or image/script request) targeting a state-changing endpoint of the IBM Security Verify Access / Verify Identity Access management interface. While an administrator is authenticated to the appliance, they are socially engineered into visiting the attacker's page, and their browser silently submits the forged request with their valid session cookies, performing an unauthorized administrative action. No public exploit code was identified at time of analysis, and success requires the victim to be logged in and to interact with attacker-controlled content.