EUVD-2026-95275
GHSA-rx8j-9r5v-j47x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed IAM endpoint over network
-
DeliverySend crafted recursive input
-
ExploitTrigger uncontrolled recursion (CWE-674)
-
ExecutionExhaust stack/CPU resources
-
ImpactCrash or hang authentication service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | Exploitation requires network reachability to an affected IBM Security Verify Access (10.0 through 10.0.9.2, including the container edition) or IBM Verify Identity Access (11.0 through 11.0.3, including the container edition) instance that processes the attacker-controllable input triggering uncontrolled recursion. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special configuration are stated as prerequisites - any exposed, unpatched instance is a candidate. The primary limiting factor is exposure: deployments where these IAM gateways are not internet-facing or are placed behind rate-limiting/reverse proxies substantially reduce reachability. The exact feature or request type that reaches the recursive code path is not specified in the description and should be verified against IBM advisory node/7291628. |
| Impact | This is a network-exploitable, unauthenticated denial-of-service flaw (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) with availability-only impact (C:N/I:N/A:H), scoring 7.5. The high CVSS is driven entirely by the ease of reaching the vulnerable code path, not by data compromise. Multiple secondary signals pull the real-world priority down: SSVC exploitation status is 'none' (no observed or public exploitation), SSVC Automatable is 'no', and SSVC Technical Impact is 'partial' rather than total. There is no CISA KEV listing and no public POC identified. No EPSS score was provided in the input, so probability-of-exploitation cannot be quantified here. The net picture is a genuinely remote, low-complexity DoS, but one that only degrades availability and shows no current exploitation evidence - a moderate, patch-on-normal-cycle priority for most environments rather than an emergency, with internet-exposed IAM gateways warranting faster remediation. |
| Exploit ScenarioDerived | A remote attacker sends specially crafted input to an exposed IBM Security Verify Access / Verify Identity Access endpoint that triggers uncontrolled recursion (CWE-674), exhausting stack or CPU/memory resources and crashing or hanging the service. No authentication or user interaction is required (PR:N/UI:N), so any network-reachable instance can be targeted. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 09, 2026
Unauthenticated remote attackers can render IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including their container editions, unavailable by driving the software into uncontrolled recursion - a stack-exhausting condition with availability-only impact (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H). Because the vector specifies PR:N/UI:N, no credentials, user interaction, or special configuration are prerequisites, so any network-reachable, unpatched instance is a candidate and exposure management is the primary limiting factor; attacks against non-internet-facing deployments placed behind rate-limiting proxies are substantially harder to sustain. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records Exploitation: none and Automatable: no with partial technical impact, so this should be treated as a high-availability-risk but not currently exploited issue.
Earlier versions of this analysis (1)
Remote denial of service affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container editions), where an uncontrolled-recursion flaw (CWE-674) allows an unauthenticated network attacker to drive a code path deep enough to exhaust stack or memory and crash or hang the service. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9) shows no authentication or user interaction is required, but attack complexity is HIGH because the crafted input must satisfy specific conditions to reliably trigger the recursive path; impact is confined to availability, with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and IBM has published a vendor fix; this is a moderate, not top-priority, issue.
RemediationAI
Apply the vendor fix: patch status is recorded as available from vendor, and IBM's remediation guidance for this issue is published at https://www.ibm.com/support/pages/node/7291628 - consult that advisory to obtain the exact fixed build for your track, since no specific fix version number is provided in the input data and should not be assumed. Until the upgrade is deployed, reduce reachability: place affected Security Verify Access / Verify Identity Access instances behind a reverse proxy or load balancer that enforces request-size, header-depth, and per-client rate limits, which raises the cost of triggering the recursion but does not eliminate the defect and can break legitimate clients that send large or deeply structured requests. Where business requirements permit, remove direct internet exposure of the IAM gateway and front it with a WAF or API gateway that rejects anomalously nested payloads, accepting the trade-off of possible false positives on legitimate recursive or deeply nested content. Because the crash loop can be driven by repeated requests, configure process supervision and alerting so restarts and stack-overflow exceptions are detected immediately, and be aware that auto-restart policies will mask, not fix, ongoing exploitation. Add monitoring for repeated process aborts, JVM stack-overflow errors, or container OOM/restart spikes on these nodes as an exploitation indicator; note that the input data does not identify which request type reaches the vulnerable path, so confirm that detail in the IBM advisory before writing narrow filtering rules. Recheck the IBM advisory periodically if a fix is not yet available for your specific build.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-674 (Uncontrolled Recursion): attacker-controllable input reaches a code path where a routine calls itself, directly or indirectly, without a depth bound or recursion guard, so each request consumes stack frames until the thread or process aborts. The affected software is IBM's identity and access management (IAM) gateway family - Security Verify Access (the former Security Access Manager / WebSEAL-style reverse proxy tier) and Verify Identity Access - which terminate and proxy HTTP(S) traffic and therefore parse untrusted request data (URLs, headers, cookies, and request bodies) before authentication occurs, which is why the flaw is reachable with PR:N/UI:N. The CPE data confirms four distinct affected artifacts: ibm:security_verify_access, ibm:verify_identity_access, and the corresponding ibm:security_verify_access_container and ibm:verify_identity_access_container editions, meaning both appliance-style and containerized deployments carry the same vulnerable code. The published description does not identify the specific endpoint, header, or parameter that reaches the recursive routine; that detail must be confirmed from IBM advisory node/7291628 before constructing targeted detection or filtering rules. Impact is confined to availability (C:N/I:N/A:H) - there is no stated confidentiality or integrity effect and no stated scope change, though repeated crashes of an authentication gateway can indirectly disrupt every application that relies on it for SSO.
Know when Security Verify Access gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, low-complexity, unauthenticated reachability of the recursive code path with no user interaction; impact is availability-only (service crash) with no confidentiality or integrity effect and unchanged scope.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
Executive ViewAI
IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3), including container editions, are vulnerable to an unauthenticated remote denial-of-service that can render identity services unavailable. No public exploit has been identified at time of analysis, and CISA SSVC records no active exploitation, but the flaw poses a high availability risk to organizations relying on these platforms for authentication and access control. Leadership should prioritize patching internet-facing instances to prevent potential authentication outages that could disrupt workforce and customer access.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Security Verify Access
View allIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
Unauthenticated remote code execution affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity A
Remote code execution is achievable in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 1
An out-of-bounds write in IBM Verify Identity Access (and its predecessor branding, IBM Security Verify Access, plus bot
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client
IBM Verify Identity Access (formerly IBM Security Verify Access) in container and appliance deployments can silently fai
Remote code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.
Arbitrary command execution in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 thro
Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0
Exploit-DB