Security Verify Access Container
Monthly
Denial of service in IBM Security Verify Access and IBM Verify Identity Access - including container editions - allows remote unauthenticated attackers to crash or indefinitely stall authentication services by triggering an infinite loop (CWE-835). All versions from 10.0 through 10.0.9.2 (Security Verify Access) and 11.0 through 11.0.3 (Verify Identity Access) are affected across both appliance and container deployments. IBM has released a patch; no public exploit code exists and no active exploitation has been recorded by CISA at time of analysis.
Cryptographic validation weakness in the IBM Security Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) allows remote attackers to bypass expected integrity checks on user-supplied data in certain configurations, affecting Security Verify Access 10.0 through 10.0.9.2 and Verify Identity Access (and its Container edition) 11.0 through 11.0.3. NVD rates this CVSS 9.8, but the vague 'certain configurations' wording and a low EPSS of 0.24% (15th percentile) with SSVC exploitation status 'none' point to a config-dependent issue rather than mass exploitation. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Verbose technical error message disclosure in IBM Verify Identity Access and IBM Security Verify Access (both appliance and container editions) allows unauthenticated remote attackers to harvest internal application details returned directly in the browser. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective container variants. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication barrier and the reconnaissance value of exposed technical data elevate this beyond a benign information leak, as harvested details can directly inform more damaging follow-on attacks against an identity management system.
IBM Verify Identity Access and IBM Security Verify Access - both appliance and container deployments - expose an incorrect authorization flaw (CWE-863) that allows an authenticated attacker with read-only privileges to perform unauthorized modifications and deployments outside their assigned permission scope. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective Container variants. A vendor patch is available per IBM advisory 7279510; no public exploit code or CISA KEV listing has been identified at time of analysis.
Open redirect vulnerability in IBM Verify Identity Access and Security Verify Access allows remote unauthenticated attackers to craft malicious URLs that redirect victims to arbitrary attacker-controlled websites, enabling phishing campaigns that exploit the trusted reputation of enterprise IAM infrastructure. Affected deployments span both on-premises and containerized editions across IBM Verify Identity Access 11.0-11.0.2 and IBM Security Verify Access 10.0-10.0.9.1. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7279510.
IBM Security Verify exposes sensitive internal information to unauthenticated remote attackers through overly detailed technical error messages rendered in the browser. Affected deployments span four product variants - IBM Verify Identity Access, IBM Security Verify Access, and their respective container editions - all of which share the same CWE-209 root cause. No public exploit code or CISA KEV listing exists at time of analysis; the primary risk is reconnaissance enablement, where leaked error details lower the effort required for subsequent, more severe attacks.
Local code execution in IBM Security Verify Access 10.0-10.0.9.1 and 11.0-11.0.2 (both container and non-container deployments) allows unauthenticated local attackers to execute malicious scripts from outside the application's control sphere. This CWE-829 inclusion of functionality from untrusted control sphere vulnerability achieves container escape (scope change to C in CVSS vector), enabling high confidentiality impact and limited integrity/availability impact. No public exploit or active exploitation confirmed at time of analysis, though the low attack complexity (AC:L) and lack of required privileges (PR:N) make this readily exploitable by local users.
Local privilege escalation to root in IBM Verify/Security Verify Access products 10.0-11.0.2 allows unauthenticated local users to gain full system control via excessive process privileges (CWE-250). The CVSS 9.3 score reflects local attack vector but no authentication requirement (PR:N) and complete system compromise with scope change. Patch available per vendor advisory. No public exploit identified at time of analysis, though the local attack vector and low complexity (AC:L) suggest straightforward exploitation once local access is obtained.
Server-Side Request Forgery (SSRF) in IBM Verify Identity Access and Security Verify Access products (versions 10.0-11.0.2) allows unauthenticated remote attackers to contact internal authentication endpoints that should be protected by the Reverse Proxy component. This bypass enables attackers to interact with restricted internal services, potentially leading to unauthorized information disclosure and limited integrity impact. EPSS data not provided, but CVSS 7.2 (High) with network-accessible, low-complexity attack vector indicates moderate real-world risk. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Denial of service in IBM Security Verify Access and IBM Verify Identity Access - including container editions - allows remote unauthenticated attackers to crash or indefinitely stall authentication services by triggering an infinite loop (CWE-835). All versions from 10.0 through 10.0.9.2 (Security Verify Access) and 11.0 through 11.0.3 (Verify Identity Access) are affected across both appliance and container deployments. IBM has released a patch; no public exploit code exists and no active exploitation has been recorded by CISA at time of analysis.
Cryptographic validation weakness in the IBM Security Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) allows remote attackers to bypass expected integrity checks on user-supplied data in certain configurations, affecting Security Verify Access 10.0 through 10.0.9.2 and Verify Identity Access (and its Container edition) 11.0 through 11.0.3. NVD rates this CVSS 9.8, but the vague 'certain configurations' wording and a low EPSS of 0.24% (15th percentile) with SSVC exploitation status 'none' point to a config-dependent issue rather than mass exploitation. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Verbose technical error message disclosure in IBM Verify Identity Access and IBM Security Verify Access (both appliance and container editions) allows unauthenticated remote attackers to harvest internal application details returned directly in the browser. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective container variants. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication barrier and the reconnaissance value of exposed technical data elevate this beyond a benign information leak, as harvested details can directly inform more damaging follow-on attacks against an identity management system.
IBM Verify Identity Access and IBM Security Verify Access - both appliance and container deployments - expose an incorrect authorization flaw (CWE-863) that allows an authenticated attacker with read-only privileges to perform unauthorized modifications and deployments outside their assigned permission scope. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective Container variants. A vendor patch is available per IBM advisory 7279510; no public exploit code or CISA KEV listing has been identified at time of analysis.
Open redirect vulnerability in IBM Verify Identity Access and Security Verify Access allows remote unauthenticated attackers to craft malicious URLs that redirect victims to arbitrary attacker-controlled websites, enabling phishing campaigns that exploit the trusted reputation of enterprise IAM infrastructure. Affected deployments span both on-premises and containerized editions across IBM Verify Identity Access 11.0-11.0.2 and IBM Security Verify Access 10.0-10.0.9.1. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7279510.
IBM Security Verify exposes sensitive internal information to unauthenticated remote attackers through overly detailed technical error messages rendered in the browser. Affected deployments span four product variants - IBM Verify Identity Access, IBM Security Verify Access, and their respective container editions - all of which share the same CWE-209 root cause. No public exploit code or CISA KEV listing exists at time of analysis; the primary risk is reconnaissance enablement, where leaked error details lower the effort required for subsequent, more severe attacks.
Local code execution in IBM Security Verify Access 10.0-10.0.9.1 and 11.0-11.0.2 (both container and non-container deployments) allows unauthenticated local attackers to execute malicious scripts from outside the application's control sphere. This CWE-829 inclusion of functionality from untrusted control sphere vulnerability achieves container escape (scope change to C in CVSS vector), enabling high confidentiality impact and limited integrity/availability impact. No public exploit or active exploitation confirmed at time of analysis, though the low attack complexity (AC:L) and lack of required privileges (PR:N) make this readily exploitable by local users.
Local privilege escalation to root in IBM Verify/Security Verify Access products 10.0-11.0.2 allows unauthenticated local users to gain full system control via excessive process privileges (CWE-250). The CVSS 9.3 score reflects local attack vector but no authentication requirement (PR:N) and complete system compromise with scope change. Patch available per vendor advisory. No public exploit identified at time of analysis, though the local attack vector and low complexity (AC:L) suggest straightforward exploitation once local access is obtained.
Server-Side Request Forgery (SSRF) in IBM Verify Identity Access and Security Verify Access products (versions 10.0-11.0.2) allows unauthenticated remote attackers to contact internal authentication endpoints that should be protected by the Reverse Proxy component. This bypass enables attackers to interact with restricted internal services, potentially leading to unauthorized information disclosure and limited integrity impact. EPSS data not provided, but CVSS 7.2 (High) with network-accessible, low-complexity attack vector indicates moderate real-world risk. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.