IBM Security Verify Access EUVD-2026-95279

Exploitation requires that a victim with an active, trusted session in the Security Verify Access / Verify Identity Access Web UI view the attacker-supplied content (UI:R) - typically an authenticated administrator or operator, which limits exploitation to successful lure/phishing or injection into a page the victim already visits. The injection itself needs no authentication (PR:N), but the payload only yields value (credential/session disclosure) once an authenticated user renders it, so the practical limiting factors are the required user interaction and the presence of an active privileged session. The input CVSS marks AV:L, which would imply local access rather than remote web delivery; defenders should confirm with IBM whether the UI is reachable only locally/over a management network, as this materially changes exposure.

This is a stored/reflected cross-site scripting flaw (CWE-79) in the Web UI of IBM Security Verify Access / Verify Identity Access, with an IBM-assigned CVSS 3.1 base score of 8.2 driven largely by a changed scope (S:C) and high confidentiality/integrity impact. The signals conflict in one important way: the vector specifies AV:L (local attack vector), yet the description and the XSS nature (an unauthenticated user embedding JavaScript into a web UI that then executes in a victim's trusted session) point to network-reachable, browser-delivered exploitation - the AV:L rating is unusual for web XSS and should be verified with IBM before treating this as local-only. PR:N confirms no authentication is required to plant the payload, but UI:R means a victim (likely an authenticated operator/admin) must view the malicious content, which lowers real-world exploitability versus a no-interaction bug. There is no EPSS score, no CISA KEV listing, and no public exploit referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the score is high but the practical risk is moderated by the user-interaction requirement and the targeted (phishing/lure) nature of XSS. A patch is available from IBM, making remediation straightforward. Net: a legitimate priority for internet-exposed or operator-facing deployments of these IAM appliances because of the credential/session-disclosure impact, but not a mass-exploitation emergency absent POC or KEV data.

An unauthenticated attacker crafts a request or input that injects arbitrary JavaScript into the Security Verify Access Web UI, then lures an authenticated administrator or user into viewing the affected page. When the victim loads it, the script runs in their trusted session and can steal session tokens or credentials, enabling account takeover of the IAM console. No public proof-of-concept is referenced, and exploitation depends on the victim interacting with the malicious content (UI:R).