Verify Identity Access
Monthly
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege user to assume the identity and privileges of another user by submitting a specially crafted network request. The vulnerability spans both on-premises and container deployments across multiple product generations (10.x and 11.x lines), broadening the exposed surface considerably. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.1 and low attack complexity make this a high-priority patching target for organizations running IBM identity infrastructure.
Privilege escalation via command injection in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated administrator to execute system commands beyond their authorized scope. Affected products span IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the container variant), with network-accessible administrative interfaces as the attack surface. Full confidentiality, integrity, and availability compromise of the underlying system is possible; no public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauthenticated remote attackers via inconsistent HTTP request parsing at the reverse proxy layer. Affected deployments span IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (software and container variants). No public exploit or CISA KEV listing has been identified at time of analysis, but the identity gateway role of this product means a successful bypass could silently undermine authentication enforcement across all downstream resources it protects.
OS command injection in IBM Security Verify Access and IBM Verify Identity Access management interfaces enables already-privileged administrators to execute arbitrary operating system commands beyond their intended scope by submitting crafted HTTP requests to the vulnerable endpoint. Affected deployments span IBM Security Verify Access 10.0-10.0.9.2, IBM Verify Identity Access 11.0-11.0.3, and the containerized variant of the latter - covering both legacy on-premises and modern container-based identity infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the full confidentiality, integrity, and availability impact against identity management infrastructure elevates organizational risk well beyond what the PR:H prerequisite might suggest at face value.
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, including container deployments) enables authenticated administrative attackers to send crafted HTTP requests to the management interface, triggering uncontrolled format string processing. Successful exploitation produces high confidentiality impact through stack memory disclosure and high availability impact through service crashes, with CVSS scope change indicating potential downstream effect on identity services beyond the management component. No public exploit is identified at time of analysis; this is a vendor-confirmed finding reported directly by IBM PSIRT.
IBM Security Verify Access and IBM Verify Identity Access - across both traditional software and container deployments - expose a Use After Free (CWE-416) memory corruption flaw in the Reverse Proxy component that authenticated network attackers can trigger under certain non-default configurations to cause a denial of service. The vulnerability carries a low CVSS base score of 3.1, reflecting high attack complexity and impact limited strictly to availability, with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including container deployments) allows network-accessible unauthenticated attackers to circumvent the Reverse Proxy component's cryptographic validation of user-supplied data under certain configurations. The CVSS 7.4 (AV:N/AC:H/PR:N) rating reflects high confidentiality and integrity impact with no privilege requirement, though exploitation depends on specific deployment configurations being active. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a targeted rather than mass-exploitation risk.
Denial of service in IBM Security Verify Access and IBM Verify Identity Access - including container editions - allows remote unauthenticated attackers to crash or indefinitely stall authentication services by triggering an infinite loop (CWE-835). All versions from 10.0 through 10.0.9.2 (Security Verify Access) and 11.0 through 11.0.3 (Verify Identity Access) are affected across both appliance and container deployments. IBM has released a patch; no public exploit code exists and no active exploitation has been recorded by CISA at time of analysis.
Cryptographic validation weakness in the IBM Security Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) allows remote attackers to bypass expected integrity checks on user-supplied data in certain configurations, affecting Security Verify Access 10.0 through 10.0.9.2 and Verify Identity Access (and its Container edition) 11.0 through 11.0.3. NVD rates this CVSS 9.8, but the vague 'certain configurations' wording and a low EPSS of 0.24% (15th percentile) with SSVC exploitation status 'none' point to a config-dependent issue rather than mass exploitation. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Verbose technical error message disclosure in IBM Verify Identity Access and IBM Security Verify Access (both appliance and container editions) allows unauthenticated remote attackers to harvest internal application details returned directly in the browser. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective container variants. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication barrier and the reconnaissance value of exposed technical data elevate this beyond a benign information leak, as harvested details can directly inform more damaging follow-on attacks against an identity management system.
IBM Verify Identity Access and IBM Security Verify Access - both appliance and container deployments - expose an incorrect authorization flaw (CWE-863) that allows an authenticated attacker with read-only privileges to perform unauthorized modifications and deployments outside their assigned permission scope. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective Container variants. A vendor patch is available per IBM advisory 7279510; no public exploit code or CISA KEV listing has been identified at time of analysis.
Open redirect vulnerability in IBM Verify Identity Access and Security Verify Access allows remote unauthenticated attackers to craft malicious URLs that redirect victims to arbitrary attacker-controlled websites, enabling phishing campaigns that exploit the trusted reputation of enterprise IAM infrastructure. Affected deployments span both on-premises and containerized editions across IBM Verify Identity Access 11.0-11.0.2 and IBM Security Verify Access 10.0-10.0.9.1. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7279510.
IBM Security Verify exposes sensitive internal information to unauthenticated remote attackers through overly detailed technical error messages rendered in the browser. Affected deployments span four product variants - IBM Verify Identity Access, IBM Security Verify Access, and their respective container editions - all of which share the same CWE-209 root cause. No public exploit code or CISA KEV listing exists at time of analysis; the primary risk is reconnaissance enablement, where leaked error details lower the effort required for subsequent, more severe attacks.
Local code execution in IBM Security Verify Access 10.0-10.0.9.1 and 11.0-11.0.2 (both container and non-container deployments) allows unauthenticated local attackers to execute malicious scripts from outside the application's control sphere. This CWE-829 inclusion of functionality from untrusted control sphere vulnerability achieves container escape (scope change to C in CVSS vector), enabling high confidentiality impact and limited integrity/availability impact. No public exploit or active exploitation confirmed at time of analysis, though the low attack complexity (AC:L) and lack of required privileges (PR:N) make this readily exploitable by local users.
Local privilege escalation to root in IBM Verify/Security Verify Access products 10.0-11.0.2 allows unauthenticated local users to gain full system control via excessive process privileges (CWE-250). The CVSS 9.3 score reflects local attack vector but no authentication requirement (PR:N) and complete system compromise with scope change. Patch available per vendor advisory. No public exploit identified at time of analysis, though the local attack vector and low complexity (AC:L) suggest straightforward exploitation once local access is obtained.
Server-Side Request Forgery (SSRF) in IBM Verify Identity Access and Security Verify Access products (versions 10.0-11.0.2) allows unauthenticated remote attackers to contact internal authentication endpoints that should be protected by the Reverse Proxy component. This bypass enables attackers to interact with restricted internal services, potentially leading to unauthorized information disclosure and limited integrity impact. EPSS data not provided, but CVSS 7.2 (High) with network-accessible, low-complexity attack vector indicates moderate real-world risk. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege user to assume the identity and privileges of another user by submitting a specially crafted network request. The vulnerability spans both on-premises and container deployments across multiple product generations (10.x and 11.x lines), broadening the exposed surface considerably. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.1 and low attack complexity make this a high-priority patching target for organizations running IBM identity infrastructure.
Privilege escalation via command injection in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated administrator to execute system commands beyond their authorized scope. Affected products span IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the container variant), with network-accessible administrative interfaces as the attack surface. Full confidentiality, integrity, and availability compromise of the underlying system is possible; no public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauthenticated remote attackers via inconsistent HTTP request parsing at the reverse proxy layer. Affected deployments span IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (software and container variants). No public exploit or CISA KEV listing has been identified at time of analysis, but the identity gateway role of this product means a successful bypass could silently undermine authentication enforcement across all downstream resources it protects.
OS command injection in IBM Security Verify Access and IBM Verify Identity Access management interfaces enables already-privileged administrators to execute arbitrary operating system commands beyond their intended scope by submitting crafted HTTP requests to the vulnerable endpoint. Affected deployments span IBM Security Verify Access 10.0-10.0.9.2, IBM Verify Identity Access 11.0-11.0.3, and the containerized variant of the latter - covering both legacy on-premises and modern container-based identity infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the full confidentiality, integrity, and availability impact against identity management infrastructure elevates organizational risk well beyond what the PR:H prerequisite might suggest at face value.
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, including container deployments) enables authenticated administrative attackers to send crafted HTTP requests to the management interface, triggering uncontrolled format string processing. Successful exploitation produces high confidentiality impact through stack memory disclosure and high availability impact through service crashes, with CVSS scope change indicating potential downstream effect on identity services beyond the management component. No public exploit is identified at time of analysis; this is a vendor-confirmed finding reported directly by IBM PSIRT.
IBM Security Verify Access and IBM Verify Identity Access - across both traditional software and container deployments - expose a Use After Free (CWE-416) memory corruption flaw in the Reverse Proxy component that authenticated network attackers can trigger under certain non-default configurations to cause a denial of service. The vulnerability carries a low CVSS base score of 3.1, reflecting high attack complexity and impact limited strictly to availability, with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including container deployments) allows network-accessible unauthenticated attackers to circumvent the Reverse Proxy component's cryptographic validation of user-supplied data under certain configurations. The CVSS 7.4 (AV:N/AC:H/PR:N) rating reflects high confidentiality and integrity impact with no privilege requirement, though exploitation depends on specific deployment configurations being active. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a targeted rather than mass-exploitation risk.
Denial of service in IBM Security Verify Access and IBM Verify Identity Access - including container editions - allows remote unauthenticated attackers to crash or indefinitely stall authentication services by triggering an infinite loop (CWE-835). All versions from 10.0 through 10.0.9.2 (Security Verify Access) and 11.0 through 11.0.3 (Verify Identity Access) are affected across both appliance and container deployments. IBM has released a patch; no public exploit code exists and no active exploitation has been recorded by CISA at time of analysis.
Cryptographic validation weakness in the IBM Security Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) allows remote attackers to bypass expected integrity checks on user-supplied data in certain configurations, affecting Security Verify Access 10.0 through 10.0.9.2 and Verify Identity Access (and its Container edition) 11.0 through 11.0.3. NVD rates this CVSS 9.8, but the vague 'certain configurations' wording and a low EPSS of 0.24% (15th percentile) with SSVC exploitation status 'none' point to a config-dependent issue rather than mass exploitation. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Verbose technical error message disclosure in IBM Verify Identity Access and IBM Security Verify Access (both appliance and container editions) allows unauthenticated remote attackers to harvest internal application details returned directly in the browser. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective container variants. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication barrier and the reconnaissance value of exposed technical data elevate this beyond a benign information leak, as harvested details can directly inform more damaging follow-on attacks against an identity management system.
IBM Verify Identity Access and IBM Security Verify Access - both appliance and container deployments - expose an incorrect authorization flaw (CWE-863) that allows an authenticated attacker with read-only privileges to perform unauthorized modifications and deployments outside their assigned permission scope. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective Container variants. A vendor patch is available per IBM advisory 7279510; no public exploit code or CISA KEV listing has been identified at time of analysis.
Open redirect vulnerability in IBM Verify Identity Access and Security Verify Access allows remote unauthenticated attackers to craft malicious URLs that redirect victims to arbitrary attacker-controlled websites, enabling phishing campaigns that exploit the trusted reputation of enterprise IAM infrastructure. Affected deployments span both on-premises and containerized editions across IBM Verify Identity Access 11.0-11.0.2 and IBM Security Verify Access 10.0-10.0.9.1. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7279510.
IBM Security Verify exposes sensitive internal information to unauthenticated remote attackers through overly detailed technical error messages rendered in the browser. Affected deployments span four product variants - IBM Verify Identity Access, IBM Security Verify Access, and their respective container editions - all of which share the same CWE-209 root cause. No public exploit code or CISA KEV listing exists at time of analysis; the primary risk is reconnaissance enablement, where leaked error details lower the effort required for subsequent, more severe attacks.
Local code execution in IBM Security Verify Access 10.0-10.0.9.1 and 11.0-11.0.2 (both container and non-container deployments) allows unauthenticated local attackers to execute malicious scripts from outside the application's control sphere. This CWE-829 inclusion of functionality from untrusted control sphere vulnerability achieves container escape (scope change to C in CVSS vector), enabling high confidentiality impact and limited integrity/availability impact. No public exploit or active exploitation confirmed at time of analysis, though the low attack complexity (AC:L) and lack of required privileges (PR:N) make this readily exploitable by local users.
Local privilege escalation to root in IBM Verify/Security Verify Access products 10.0-11.0.2 allows unauthenticated local users to gain full system control via excessive process privileges (CWE-250). The CVSS 9.3 score reflects local attack vector but no authentication requirement (PR:N) and complete system compromise with scope change. Patch available per vendor advisory. No public exploit identified at time of analysis, though the local attack vector and low complexity (AC:L) suggest straightforward exploitation once local access is obtained.
Server-Side Request Forgery (SSRF) in IBM Verify Identity Access and Security Verify Access products (versions 10.0-11.0.2) allows unauthenticated remote attackers to contact internal authentication endpoints that should be protected by the Reverse Proxy component. This bypass enables attackers to interact with restricted internal services, potentially leading to unauthorized information disclosure and limited integrity impact. EPSS data not provided, but CVSS 7.2 (High) with network-accessible, low-complexity attack vector indicates moderate real-world risk. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.