IBM Security Verify Access EUVD-2026-95284

Exploitation requires that IBM Security Verify Access / Verify Identity Access be deployed in front of one of the 'some web servers' for which authorization is not correctly enforced - i.e., the flaw is tied to specific protected web-server configurations rather than all deployments, as reflected by the AC:H rating. The attacker needs network access to the reachable protected resource (AV:N) and no authentication (PR:N) or user interaction (UI:N). Limiting factors: the high attack complexity and the description's scoping to 'some' web servers mean default or unaffected configurations are not exploitable; organizations must confirm whether their specific policy/web-server setup is among the affected ones per IBM advisory node/7291628.

This is a moderate-severity improper authorization flaw (CWE-285) scored CVSS 5.9 by IBM. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N indicates a network-reachable, unauthenticated (PR:N) weakness but with high attack complexity (AC:H), meaning successful exploitation depends on conditions outside the attacker's control - consistent with the description's qualifier that authorization 'may not' be enforced correctly for 'some' web servers, implying specific configurations are affected rather than all deployments. Impact is integrity-only (I:H, C:N, A:N), so this permits unauthorized modification/access-control bypass but is not scored as directly exposing data or causing outages. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood signals are absent; there is no public exploit identified at time of analysis and it is not in CISA KEV. Net assessment: this is a legitimate patch-worthy authorization bypass in a security product (IAM gateway), which raises its practical importance, but the AC:H rating, config-dependent scope, and absence of any exploitation evidence place it below the urgency of high-EPSS or KEV-listed flaws. Note the vagueness of the vendor description ('may not enforce authorization correctly for some web servers') limits precise scoping - verify exact affected configurations with IBM advisory node/7291628.

A remote, unauthenticated attacker sends requests to a reverse-proxied or protected web server fronted by IBM Verify Access in an affected configuration, where the access-control policy fails to be enforced, allowing them to reach or modify a resource that should have required authorization. Because attack complexity is high, the attacker likely must target a specific vulnerable web-server configuration or race/condition rather than any default deployment. No public exploit code was identified at time of analysis.