EUVD-2026-95282
GHSA-94ww-j36m-jv3h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Improper authentication in a network-facing access gateway allows unauthenticated remote bypass (AV:N/AC:L/PR:N/UI:N) compromising confidentiality and integrity but not availability (A:N).
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication.
AnalysisAI
Authentication bypass in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 lets remote, unauthenticated attackers circumvent security restrictions and gain access they should not have, with the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicating high confidentiality and integrity impact without any prior credentials or user interaction. The same flaw extends to the container editions of both products (Security Verify Access Container and Verify Identity Access Container), which are commonly deployed as internet-facing policy-enforcement points, so exposure of the affected component to untrusted networks is the primary precondition. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required, implying remote unauthenticated exploitation against affected IBM Security Verify Access (10.0-10.0.9.2) and Verify Identity Access (11.0-11.0.3) deployments, including their container editions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority flaw that aligns strongly across the available signals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status: Patch available per vendor advisory - IBM has published a fix and affected-product guidance at https://www.ibm.com/support/pages/node/7291628; because the exact fixed build numbers are not supplied in the available data, confirm the precise remediation level in that bulletin and upgrade IBM Security Verify Access beyond 10.0.9.2 and IBM Verify Identity Access beyond 11.0.3 (plus any affected container images) to the vendor-designated fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every instance of IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including Security Verify Access Container and Verify Identity Access Container deployments, and determine which are reachable from untrusted networks; where internet exposure cannot be justified, restrict or remove that exposure through network controls as a stopgap and confirm with IBM Support which fix level applies to each release train. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Verify Access
View allIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
An out-of-bounds write in IBM Verify Identity Access (and its predecessor branding, IBM Security Verify Access, plus bot
Unauthenticated remote code execution affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity A
Remote code execution is achievable in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 1
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client
IBM Verify Identity Access (formerly IBM Security Verify Access) in container and appliance deployments can silently fai
Arbitrary code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access
Authentication bypass in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11
Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today