Verify Identity Access Container
Monthly
Information disclosure in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the Security Verify Access Container and Verify Identity Access Container editions) allows unauthenticated remote attackers to read sensitive data from a network-reachable instance, per the CVSS vector AV:N/AC:L/PR:N/UI:N with confidentiality impact rated High and no integrity or availability effect. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, with the attack classified as not automatable and only partial technical impact, indicating targeted rather than mass-scannable abuse. Vendor-released fixes are available from IBM, so exposure is primarily a function of how reachable the identity appliance or container endpoints are from untrusted networks.
Improper authorization enforcement in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 can allow unauthenticated remote attackers (PR:N, UI:N) to bypass access controls and alter protected content or state (I:H, C:N, A:N) when the product is deployed in front of certain web servers. The flaw, however, is configuration-dependent: as reflected by the AV:N/AC:H vector and IBM's scoping to 'some' web servers, only specific protected web-server integrations are exposed, and default or unaffected setups are not exploitable. No public exploit code or confirmed active exploitation was identified at time of analysis, and IBM rates the issue 5.9 (moderate); the affected deployments also include the containerized editions of both products.
Authentication bypass in IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including their container editions, allows a remote, unauthenticated attacker to defeat security restrictions and gain unauthorized access to functionality that should be protected. With a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:N), the flaw is network-reachable, low complexity, and requires no credentials or user interaction; the impact is rated as high on integrity, meaning an attacker can alter protected data or configuration through the bypass. The only practical precondition is that the affected authentication or management interface be reachable by the attacker. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV); a vendor patch is available per IBM advisory node 7291628.
Remote code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including the containerized editions of both products, because a protection mechanism fails to prevent an authenticated principal from influencing code execution paths. Successful exploitation requires only a valid low-privilege account and network access to the product interface (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) - no user interaction or race condition is needed - and yields full compromise of confidentiality, integrity and availability of the affected instance. At the time of analysis, no public exploit code has been identified for this CVE and there is no confirmed active exploitation, but the low attack complexity and the fact that the affected systems are identity and access management infrastructure make the issue a high-priority patching target; IBM has published a vendor remediation advisory.
Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the containerized editions) allows a remote attacker who already holds valid credentials to slip crafted parameters into command or process arguments and trigger unauthorized actions, with high impact to confidentiality, integrity, and availability (CVSS 8.8). Exploitation requires authenticated access (CVSS vector PR:L) and no user interaction (UI:N), so the exposed population is limited to existing platform users rather than anonymous internet traffic. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and the affected systems are typically high-value identity infrastructure, making prompt remediation worthwhile.
Authentication bypass in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the container editions) allows a remote, unauthenticated attacker to defeat the product's authentication control entirely, with no user interaction required. The 7.5 CVSS score reflects a high integrity impact only - the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) assigns no confidentiality or availability impact - so the practical effect is that an attacker can perform authenticated actions with the privileges of a legitimate session while exposing no data directly. IBM has published a vendor fix via support node 7291628, and no public exploit code has been identified at time of analysis; this is a credible operational priority but not a confirmed emergency.
Unauthenticated remote attackers can render IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including their container editions, unavailable by driving the software into uncontrolled recursion - a stack-exhausting condition with availability-only impact (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H). Because the vector specifies PR:N/UI:N, no credentials, user interaction, or special configuration are prerequisites, so any network-reachable, unpatched instance is a candidate and exposure management is the primary limiting factor; attacks against non-internet-facing deployments placed behind rate-limiting proxies are substantially harder to sustain. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records Exploitation: none and Automatable: no with partial technical impact, so this should be treated as a high-availability-risk but not currently exploited issue.
Path traversal (CWE-22) in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 allows a remote, unauthenticated attacker to write arbitrary files on the affected appliance or container by supplying crafted path components. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5) exploitation is network-reachable, low-complexity and unauthenticated, with high integrity impact and no confirmed confidentiality or availability impact - a file-write primitive rather than a file-read or denial-of-service bug. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the vendor has released a patch and the sole reference is IBM's advisory at https://www.ibm.com/support/pages/node/7291628. Exposure is bounded by network reachability: instances sitting behind reverse proxies or confined to internal/DMZ segments that attackers cannot reach are not directly exploitable.
Arbitrary command execution in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container images) allows a remote attacker holding a valid low-privilege account to run commands on the underlying system by slipping argument delimiters into data that is passed to a backend process without neutralization (CWE-88). The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) means the attack is network-reachable with no user interaction and yields full loss of confidentiality, integrity, and availability, but exploitation is not possible fully unauthenticated - the attacker must already have credentials, which narrows the realistic threat to insiders, compromised low-privilege accounts, and post-compromise escalation. There is no public exploit identified at time of analysis, though the vendor has published a patch, so unpatched deployments within the affected ranges should be treated as exposed to any authenticated user.
Cross-site request forgery in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container editions) lets a remote attacker who lures a logged-in user into loading attacker-controlled content submit unauthorized, privileged state-changing requests through that victim's authenticated session; CVSS 3.1 rates it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attacker needs no credentials of their own, but successful abuse depends on a concurrently authenticated victim - most damagingly an administrator - plus a social-engineering/user-interaction step, so exposure is greatest where the management interface is internet-reachable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); a vendor patch is available per IBM's advisory.
Unauthenticated remote code execution affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 - including their containerized editions - through deserialization of untrusted data, allowing an attacker who can reach the affected service to run arbitrary code on the system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms the flaw is network-reachable and requires no authentication, privileges, or user interaction, so any exposed, unpatched instance should be considered directly exploitable; the only real gating factors are running an affected build and whether the vulnerable endpoint is network-accessible. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a vendor patch is available and the pre-authentication nature of the issue places it in the highest remediation priority tier.
Remote code execution is achievable in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, because the affected services deserialize untrusted data received over the network. The flaw is reachable without authentication and without user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), allowing an attacker who can reach the vulnerable endpoint to run arbitrary code with the privileges of the affected process. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but a vendor patch is available and the only practical barrier to exploitation is network reachability of the exposed service.
Arbitrary code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container editions) when an attacker who already holds administrative privileges on the appliance and can reach the local management interface supplies input that overflows a fixed-size stack buffer. The assessed CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with CWE-787 as the root cause, so the flaw is high-severity on impact but gated by a strong prerequisite: administrative control of the management plane rather than unauthenticated reach. Patch available per vendor advisory (IBM support page node/7291628); there is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA SSVC decision points record Exploitation: none, Automatable: no, Technical Impact: partial.
IBM Verify Identity Access (formerly IBM Security Verify Access) in container and appliance deployments can silently fail to apply management password-change operations, leaving a supposed-to-be-rotated administrative credential valid for network-accessible management interfaces. The flaw, tracked as CWE-522 (Insufficiently Protected Credentials), affects 11.0.0 through 11.0.3 Interim Fix 001 and the 10.0.0 through 10.0.9.2 Interim Fix 001 streams, with a high confidentiality and integrity impact on the affected management plane. Vendor-rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) presents this as trivially unauthenticated, and our assessed vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms the high confidentiality and integrity impact but applies a higher attack complexity because practical exploitation requires reaching the management interface and possessing an old, default, or previously leaked management credential that the operator believed had been superseded; no public exploit has been identified at time of analysis and EPSS is negligible at 0.13% (3rd percentile), and IBM has released a patch.
IBM Verify Identity Access (formerly Security Verify Access) can be driven into a denial-of-service state by a remote, unauthenticated attacker who sends crafted requests that the product fails to validate for resource consumption. Only availability is impacted (CVSS 7.5, C:N/I:N/A:H); confidentiality and integrity are untouched. No public exploit code and no CISA KEV entry were identified in the provided intelligence, and the vendor has published a fix; the practical risk is therefore tied to exposure of the affected endpoints rather than to confirmed active exploitation.
An out-of-bounds write in IBM Verify Identity Access (and its predecessor branding, IBM Security Verify Access, plus both container editions) lets an attacker reach the vulnerability over the network without credentials or user interaction, with the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating full loss of confidentiality, integrity, and availability if the memory-corruption primitive is successfully converted into code execution or a crash. Affected builds are Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001, Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, and the matching Verify Identity Access Container and Security Verify Access Container releases; patched or newer installs are not affected. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV does not list this CVE), and EPSS is low at 0.14 percent (4th percentile), so the practical near-term risk is driven by the product's position on the security perimeter rather than by observed attack activity.
IBM Security Verify Identity Access (formerly Security Verify Access) ships a reverse proxy component that, in certain configurations, performs weaker-than-expected cryptographic validation of user-supplied data. A remote, unauthenticated attacker (CVSS 3.1 AV:N/PR:N/UI:N) can therefore submit crafted data that is improperly validated, exposing protected resources and sensitive identity information; the impact is confidentiality-only (C:H/I:N/A:N) with a base score of 7.5. No CISA KEV entry and no public exploit code were identified at time of analysis, and IBM has published a vendor fix. Affected lines are Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access / Security Verify Access Container 10.0.0 through 10.0.9.2 Interim Fix 001.
IBM Verify Identity Access (and its predecessor Security Verify Access) contains an improper authorization flaw that lets an administrator with limited entitlements execute additional commands beyond their granted privileges by supplying specially crafted input to the product's administrative functionality. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity and availability impact but requiring an existing privileged account to reach. No public exploit code or CISA KEV entry was identified at time of analysis, and IBM has published a vendor fix via its support advisory.
IBM Verify Identity Access and its container edition (versions 11.0.0 through 11.0.3 Interim Fix 001), along with the legacy Security Verify Access and container edition (10.0.0 through 10.0.9.2 Interim Fix 001), fail to properly validate user-supplied management requests, so an administrator whose role is not entitled to certain commands can execute them anyway. The vendor scores this High at CVSS 8.1, but exploitation requires prior access to the administrative/management interface as a role-restricted administrator and a specially crafted request capable of defeating the validation logic, and no public exploit identified at time of analysis (EPSS 0.14%, 4th percentile) exists, while a vendor fix is available.
Unauthenticated remote denial of service in IBM Verify Identity Access (the current name of IBM Security Verify Access) and its container editions, where crafted incoming requests reach a handler that fails to validate resource consumption, leading to uncontrolled recursion (CWE-674) and service exhaustion. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) means any network-reachable instance can be knocked offline without credentials, but confidentiality and integrity are unaffected. IBM has published a vendor fix; no public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided.
IBM Verify Identity Access (formerly IBM Security Verify Access) fails to adequately validate or bound the resources consumed by incoming requests, allowing a remote, unauthenticated attacker to drive resource exhaustion and deny service to legitimate users. Affected builds include Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, in both software and container form factors. IBM has released a fix, EPSS is low at 0.21% (11th percentile), and there is no public exploit identified at time of analysis.
Server-side template injection (SSTI) in IBM Verify Identity Access and Security Verify Access exposes sensitive information to unauthenticated remote attackers via a network-accessible endpoint. The vulnerability affects both traditional appliance deployments and container variants across IBM's IAM product family (versions 10.x and 11.x), and is particularly notable given that IAM platforms routinely handle authentication tokens, user credentials, and security policy configuration - data whose disclosure has outsized downstream impact. IBM has assessed the impact as confidentiality-only (I:N/A:N in the CVSS vector), suggesting the template injection is sandboxed against code execution, but no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege user to assume the identity and privileges of another user by submitting a specially crafted network request. The vulnerability spans both on-premises and container deployments across multiple product generations (10.x and 11.x lines), broadening the exposed surface considerably. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.1 and low attack complexity make this a high-priority patching target for organizations running IBM identity infrastructure.
Privilege escalation via command injection in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated administrator to execute system commands beyond their authorized scope. Affected products span IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the container variant), with network-accessible administrative interfaces as the attack surface. Full confidentiality, integrity, and availability compromise of the underlying system is possible; no public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauthenticated remote attackers via inconsistent HTTP request parsing at the reverse proxy layer. Affected deployments span IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (software and container variants). No public exploit or CISA KEV listing has been identified at time of analysis, but the identity gateway role of this product means a successful bypass could silently undermine authentication enforcement across all downstream resources it protects.
OS command injection in IBM Security Verify Access and IBM Verify Identity Access management interfaces enables already-privileged administrators to execute arbitrary operating system commands beyond their intended scope by submitting crafted HTTP requests to the vulnerable endpoint. Affected deployments span IBM Security Verify Access 10.0-10.0.9.2, IBM Verify Identity Access 11.0-11.0.3, and the containerized variant of the latter - covering both legacy on-premises and modern container-based identity infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the full confidentiality, integrity, and availability impact against identity management infrastructure elevates organizational risk well beyond what the PR:H prerequisite might suggest at face value.
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, including container deployments) enables authenticated administrative attackers to send crafted HTTP requests to the management interface, triggering uncontrolled format string processing. Successful exploitation produces high confidentiality impact through stack memory disclosure and high availability impact through service crashes, with CVSS scope change indicating potential downstream effect on identity services beyond the management component. No public exploit is identified at time of analysis; this is a vendor-confirmed finding reported directly by IBM PSIRT.
Authentication bypass in IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including container deployments) allows network-accessible unauthenticated attackers to circumvent the Reverse Proxy component's cryptographic validation of user-supplied data under certain configurations. The CVSS 7.4 (AV:N/AC:H/PR:N) rating reflects high confidentiality and integrity impact with no privilege requirement, though exploitation depends on specific deployment configurations being active. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a targeted rather than mass-exploitation risk.
Denial of service in IBM Security Verify Access and IBM Verify Identity Access - including container editions - allows remote unauthenticated attackers to crash or indefinitely stall authentication services by triggering an infinite loop (CWE-835). All versions from 10.0 through 10.0.9.2 (Security Verify Access) and 11.0 through 11.0.3 (Verify Identity Access) are affected across both appliance and container deployments. IBM has released a patch; no public exploit code exists and no active exploitation has been recorded by CISA at time of analysis.
Cryptographic validation weakness in the IBM Security Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) allows remote attackers to bypass expected integrity checks on user-supplied data in certain configurations, affecting Security Verify Access 10.0 through 10.0.9.2 and Verify Identity Access (and its Container edition) 11.0 through 11.0.3. NVD rates this CVSS 9.8, but the vague 'certain configurations' wording and a low EPSS of 0.24% (15th percentile) with SSVC exploitation status 'none' point to a config-dependent issue rather than mass exploitation. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Local code execution in IBM Security Verify Access 10.0-10.0.9.1 and 11.0-11.0.2 (both container and non-container deployments) allows unauthenticated local attackers to execute malicious scripts from outside the application's control sphere. This CWE-829 inclusion of functionality from untrusted control sphere vulnerability achieves container escape (scope change to C in CVSS vector), enabling high confidentiality impact and limited integrity/availability impact. No public exploit or active exploitation confirmed at time of analysis, though the low attack complexity (AC:L) and lack of required privileges (PR:N) make this readily exploitable by local users.
Local privilege escalation to root in IBM Verify/Security Verify Access products 10.0-11.0.2 allows unauthenticated local users to gain full system control via excessive process privileges (CWE-250). The CVSS 9.3 score reflects local attack vector but no authentication requirement (PR:N) and complete system compromise with scope change. Patch available per vendor advisory. No public exploit identified at time of analysis, though the local attack vector and low complexity (AC:L) suggest straightforward exploitation once local access is obtained.
Server-Side Request Forgery (SSRF) in IBM Verify Identity Access and Security Verify Access products (versions 10.0-11.0.2) allows unauthenticated remote attackers to contact internal authentication endpoints that should be protected by the Reverse Proxy component. This bypass enables attackers to interact with restricted internal services, potentially leading to unauthorized information disclosure and limited integrity impact. EPSS data not provided, but CVSS 7.2 (High) with network-accessible, low-complexity attack vector indicates moderate real-world risk. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
High-privileged, already-authenticated administrators on the management interface of IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 can forge or tamper with audit log records by injecting argument delimiters into the logging functionality (CWE-88). Because the CVSS vector is PR:H, only an account that already holds elevated privileges on the management console can reach the affected feature, so realistic exposure is confined to insider misuse or an attacker who has already stolen a privileged credential; no user interaction is required and the interface is network-reachable, but impact is limited to audit log integrity with no confidentiality or availability effect. There is no vendor indication of exploitation, and no public exploit identified at time of analysis; severity is low (CVSS 2.7), and a patch is available per the vendor advisory.
SQL injection (CWE-89) in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 allows a remote attacker holding a valid low-privileged session to inject SQL through standard authenticated functionality, enabling unauthorized modification of backend data and partial denial of service. The vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), so confidentiality is not assessed as impacted; the practical barrier is the requirement for credentials, not a special configuration. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and IBM has published a fix via its support portal.
Cross-site scripting (CWE-79) in the Web UI of IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 - including their container editions - lets an attacker inject arbitrary JavaScript into pages rendered by the interface, which can execute in the browser of an authenticated administrator or operator with an active trusted session and potentially disclose credentials or session data. The injection itself requires no authentication (the supplied vector is PR:N), but the payload is only harmful when a victim loads the crafted content (UI:R), so exploitation depends on a successful lure, a poisoned page, or injection into a view the victim already opens. IBM rates this 8.2 (scope changed, high confidentiality and integrity impact); no public exploit code or active exploitation has been identified at time of analysis, though the faulted UI is a high-value administrative target. Note a vector discrepancy: the published CVSS marks AV:L whereas the independent assessment scores AV:N, so defenders should confirm with IBM whether the affected UI is reachable remotely or only from a local/management network, since that materially changes exposure.
Security restriction bypass in IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including their container images, lets a remote attacker who already holds a valid low-privilege session circumvent authentication controls and gain high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Because the vector is PR:L, anonymous or unauthenticated attackers cannot trigger this on their own; the attacker must first possess valid credentials or a session, after which the bypass is low-complexity, requires no user interaction, and is reliably reproducible. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but a vendor patch is available, so the issue should be treated as a credible, above-average-priority fix rather than an emergency.
An authenticated user can exhaust server resources in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including the containerized editions, by submitting a specially crafted HTTP query that triggers uncontrolled resource allocation, resulting in a denial of service (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation requires a valid authenticated session on the affected HTTP interface (PR:L); there is no confidentiality or integrity impact, only availability. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate-priority availability defect rather than a top-tier emergency; vendor patching is available per IBM's advisory.
Authentication workflow bypass in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 allows a remote authenticated attacker who already holds valid first-factor credentials or an active session to skip the configured additional authentication workflow steps - such as step-up authentication, multi-factor prompts, or multi-step policy flows. Rated CVSS 6.5 (moderate), the flaw only affects deployments that actually enforce an additional authentication workflow; environments without one have nothing for the bypass to defeat. Exploitation requires the extra-workflow feature to be configured and the attacker to be a remote authenticated actor, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; note that IBM's supplied CVSS vector (PR:N) contradicts its own 'remote authenticated attacker' description and our independent assessment, which uses PR:L and should be reconciled with the vendor.
A remote, unauthenticated attacker can trigger a limited heap-based out-of-bounds read in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, by sending a specially crafted request to an exposed instance. Successful exploitation is confined to a partial memory read that can cause a denial-of-service condition; there is no confidentiality or integrity impact and no code execution path described. This is a low-severity issue (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) that should be treated as low priority despite its network-facing nature, and at time of analysis no public exploit code and no confirmed active exploitation were identified; a vendor patch is available via IBM support node 7291628.
Authenticated cross-site scripting (XSS) in the local management interface of IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 allows a low-privileged authenticated user to embed arbitrary JavaScript into the Web UI when the deployment is in certain non-default configurations, potentially altering the interface's intended behaviour and disclosing credentials within a trusted session. Exploitation requires an existing account on the management interface (CVSS PR:L) and, in practice, a second trusted user such as an administrator who renders the injected content in their own session; no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is rated low-to-moderate priority - network-reachable but gated by high attack complexity (AC:H) attributable to the configuration prerequisite and by user interaction in the assessed vector.
Cross-site scripting in the IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3) Web UI allows an authenticated user to embed arbitrary JavaScript into a field that is later rendered to another user, so the payload executes within that victim's trusted session (scope change, S:C) and can lead to credential or session disclosure. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4) confirms remote reachability but requires a valid low-privileged account plus victim interaction; there is no availability impact and the exposure is limited to data reachable inside the victim's session. No public exploit code exists and there is no confirmed active exploitation (CISA KEV) at the time of analysis; a vendor patch is available per the IBM advisory.
Parameter injection in the IBM Security Verify Access (Verify Identity Access) reverse proxy - the WebSEAL component - lets unauthenticated, network-reachable attackers have crafted parameters carried into requests the proxy constructs toward back-end or third-party services, potentially manipulating how those downstream services interpret the call. Only deployments below the listed interim-fix levels (Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, plus their container variants) are affected, and realized impact depends heavily on the behaviour of the downstream service, which is why this is scored AC:H with a limited confidentiality but high integrity effect rather than an urgent, broadly weaponizable flaw. There is no public exploit identified at time of analysis and EPSS is only 0.15% (5th percentile), so this is a moderate-priority issue to schedule rather than an emergency; the vendor has published patch guidance.
Missing origin validation in IBM Verify Identity Access and Security Verify Access (including their container editions) lets an unauthenticated, remote attacker ride an authenticated user's live session and carry out operations as that victim, potentially enabling follow-on attacks against the deployment. Exploitation requires the victim - a logged-in Verify Identity Access / Security Verify Access user - to be lured into visiting attacker-controlled web content while their session is active (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, 5.4), so confidentiality and integrity impact is limited to the victim's own privilege scope with no availability loss. No public exploit code has been identified and the flaw is not confirmed actively exploited (CISA KEV); EPSS is 0.15% (4th percentile), and vendor-released fixes are available per IBM's advisory, making this a moderate-severity, likely low-priority issue in real-world terms.
Cross-site scripting (CWE-79) in IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, including the corresponding container editions, allows a remote unauthenticated attacker to run script in the browser of a logged-in user who follows a crafted link, potentially hijacking an authenticated session or performing actions as that user. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which reflects the need for victim interaction and the limited but scope-changing confidentiality and integrity impact typical of reflected XSS. There is no public exploit code identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and the EPSS probability is only 0.20% (10th percentile), so this is a patching-hygiene issue rather than an emergency response item.
An open redirect flaw in IBM Verify Identity Access and Security Verify Access (including their container editions) lets a remote, unauthenticated attacker craft a link pointing at the product's own trusted domain that silently forwards the victim to an attacker-controlled site. Because the URL originates from the legitimate IBM identity provider, the redirect is highly convincing and can be used to harvest credentials or push further phishing stages. IBM has released fixes (Interim Fix 001 for the affected 10.0.0–10.0.9.2 and 11.0.0–11.0.3 streams); there is no public exploit identified at time of analysis, exploitation requires the victim to click a crafted link, and EPSS is very low at 0.19% (9th percentile).
IBM Security Verify Access and IBM Verify Identity Access - across both traditional software and container deployments - expose a Use After Free (CWE-416) memory corruption flaw in the Reverse Proxy component that authenticated network attackers can trigger under certain non-default configurations to cause a denial of service. The vulnerability carries a low CVSS base score of 3.1, reflecting high attack complexity and impact limited strictly to availability, with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis.
Verbose technical error message disclosure in IBM Verify Identity Access and IBM Security Verify Access (both appliance and container editions) allows unauthenticated remote attackers to harvest internal application details returned directly in the browser. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective container variants. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication barrier and the reconnaissance value of exposed technical data elevate this beyond a benign information leak, as harvested details can directly inform more damaging follow-on attacks against an identity management system.
IBM Verify Identity Access and IBM Security Verify Access - both appliance and container deployments - expose an incorrect authorization flaw (CWE-863) that allows an authenticated attacker with read-only privileges to perform unauthorized modifications and deployments outside their assigned permission scope. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective Container variants. A vendor patch is available per IBM advisory 7279510; no public exploit code or CISA KEV listing has been identified at time of analysis.
Open redirect vulnerability in IBM Verify Identity Access and Security Verify Access allows remote unauthenticated attackers to craft malicious URLs that redirect victims to arbitrary attacker-controlled websites, enabling phishing campaigns that exploit the trusted reputation of enterprise IAM infrastructure. Affected deployments span both on-premises and containerized editions across IBM Verify Identity Access 11.0-11.0.2 and IBM Security Verify Access 10.0-10.0.9.1. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7279510.
IBM Security Verify exposes sensitive internal information to unauthenticated remote attackers through overly detailed technical error messages rendered in the browser. Affected deployments span four product variants - IBM Verify Identity Access, IBM Security Verify Access, and their respective container editions - all of which share the same CWE-209 root cause. No public exploit code or CISA KEV listing exists at time of analysis; the primary risk is reconnaissance enablement, where leaked error details lower the effort required for subsequent, more severe attacks.
Information disclosure in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the Security Verify Access Container and Verify Identity Access Container editions) allows unauthenticated remote attackers to read sensitive data from a network-reachable instance, per the CVSS vector AV:N/AC:L/PR:N/UI:N with confidentiality impact rated High and no integrity or availability effect. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, with the attack classified as not automatable and only partial technical impact, indicating targeted rather than mass-scannable abuse. Vendor-released fixes are available from IBM, so exposure is primarily a function of how reachable the identity appliance or container endpoints are from untrusted networks.
Improper authorization enforcement in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 can allow unauthenticated remote attackers (PR:N, UI:N) to bypass access controls and alter protected content or state (I:H, C:N, A:N) when the product is deployed in front of certain web servers. The flaw, however, is configuration-dependent: as reflected by the AV:N/AC:H vector and IBM's scoping to 'some' web servers, only specific protected web-server integrations are exposed, and default or unaffected setups are not exploitable. No public exploit code or confirmed active exploitation was identified at time of analysis, and IBM rates the issue 5.9 (moderate); the affected deployments also include the containerized editions of both products.
Authentication bypass in IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including their container editions, allows a remote, unauthenticated attacker to defeat security restrictions and gain unauthorized access to functionality that should be protected. With a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:N), the flaw is network-reachable, low complexity, and requires no credentials or user interaction; the impact is rated as high on integrity, meaning an attacker can alter protected data or configuration through the bypass. The only practical precondition is that the affected authentication or management interface be reachable by the attacker. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV); a vendor patch is available per IBM advisory node 7291628.
Remote code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including the containerized editions of both products, because a protection mechanism fails to prevent an authenticated principal from influencing code execution paths. Successful exploitation requires only a valid low-privilege account and network access to the product interface (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) - no user interaction or race condition is needed - and yields full compromise of confidentiality, integrity and availability of the affected instance. At the time of analysis, no public exploit code has been identified for this CVE and there is no confirmed active exploitation, but the low attack complexity and the fact that the affected systems are identity and access management infrastructure make the issue a high-priority patching target; IBM has published a vendor remediation advisory.
Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the containerized editions) allows a remote attacker who already holds valid credentials to slip crafted parameters into command or process arguments and trigger unauthorized actions, with high impact to confidentiality, integrity, and availability (CVSS 8.8). Exploitation requires authenticated access (CVSS vector PR:L) and no user interaction (UI:N), so the exposed population is limited to existing platform users rather than anonymous internet traffic. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and the affected systems are typically high-value identity infrastructure, making prompt remediation worthwhile.
Authentication bypass in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the container editions) allows a remote, unauthenticated attacker to defeat the product's authentication control entirely, with no user interaction required. The 7.5 CVSS score reflects a high integrity impact only - the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) assigns no confidentiality or availability impact - so the practical effect is that an attacker can perform authenticated actions with the privileges of a legitimate session while exposing no data directly. IBM has published a vendor fix via support node 7291628, and no public exploit code has been identified at time of analysis; this is a credible operational priority but not a confirmed emergency.
Unauthenticated remote attackers can render IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including their container editions, unavailable by driving the software into uncontrolled recursion - a stack-exhausting condition with availability-only impact (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H). Because the vector specifies PR:N/UI:N, no credentials, user interaction, or special configuration are prerequisites, so any network-reachable, unpatched instance is a candidate and exposure management is the primary limiting factor; attacks against non-internet-facing deployments placed behind rate-limiting proxies are substantially harder to sustain. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records Exploitation: none and Automatable: no with partial technical impact, so this should be treated as a high-availability-risk but not currently exploited issue.
Path traversal (CWE-22) in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 allows a remote, unauthenticated attacker to write arbitrary files on the affected appliance or container by supplying crafted path components. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5) exploitation is network-reachable, low-complexity and unauthenticated, with high integrity impact and no confirmed confidentiality or availability impact - a file-write primitive rather than a file-read or denial-of-service bug. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the vendor has released a patch and the sole reference is IBM's advisory at https://www.ibm.com/support/pages/node/7291628. Exposure is bounded by network reachability: instances sitting behind reverse proxies or confined to internal/DMZ segments that attackers cannot reach are not directly exploitable.
Arbitrary command execution in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container images) allows a remote attacker holding a valid low-privilege account to run commands on the underlying system by slipping argument delimiters into data that is passed to a backend process without neutralization (CWE-88). The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) means the attack is network-reachable with no user interaction and yields full loss of confidentiality, integrity, and availability, but exploitation is not possible fully unauthenticated - the attacker must already have credentials, which narrows the realistic threat to insiders, compromised low-privilege accounts, and post-compromise escalation. There is no public exploit identified at time of analysis, though the vendor has published a patch, so unpatched deployments within the affected ranges should be treated as exposed to any authenticated user.
Cross-site request forgery in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container editions) lets a remote attacker who lures a logged-in user into loading attacker-controlled content submit unauthorized, privileged state-changing requests through that victim's authenticated session; CVSS 3.1 rates it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attacker needs no credentials of their own, but successful abuse depends on a concurrently authenticated victim - most damagingly an administrator - plus a social-engineering/user-interaction step, so exposure is greatest where the management interface is internet-reachable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); a vendor patch is available per IBM's advisory.
Unauthenticated remote code execution affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 - including their containerized editions - through deserialization of untrusted data, allowing an attacker who can reach the affected service to run arbitrary code on the system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms the flaw is network-reachable and requires no authentication, privileges, or user interaction, so any exposed, unpatched instance should be considered directly exploitable; the only real gating factors are running an affected build and whether the vulnerable endpoint is network-accessible. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a vendor patch is available and the pre-authentication nature of the issue places it in the highest remediation priority tier.
Remote code execution is achievable in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, because the affected services deserialize untrusted data received over the network. The flaw is reachable without authentication and without user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), allowing an attacker who can reach the vulnerable endpoint to run arbitrary code with the privileges of the affected process. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but a vendor patch is available and the only practical barrier to exploitation is network reachability of the exposed service.
Arbitrary code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container editions) when an attacker who already holds administrative privileges on the appliance and can reach the local management interface supplies input that overflows a fixed-size stack buffer. The assessed CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with CWE-787 as the root cause, so the flaw is high-severity on impact but gated by a strong prerequisite: administrative control of the management plane rather than unauthenticated reach. Patch available per vendor advisory (IBM support page node/7291628); there is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA SSVC decision points record Exploitation: none, Automatable: no, Technical Impact: partial.
IBM Verify Identity Access (formerly IBM Security Verify Access) in container and appliance deployments can silently fail to apply management password-change operations, leaving a supposed-to-be-rotated administrative credential valid for network-accessible management interfaces. The flaw, tracked as CWE-522 (Insufficiently Protected Credentials), affects 11.0.0 through 11.0.3 Interim Fix 001 and the 10.0.0 through 10.0.9.2 Interim Fix 001 streams, with a high confidentiality and integrity impact on the affected management plane. Vendor-rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) presents this as trivially unauthenticated, and our assessed vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms the high confidentiality and integrity impact but applies a higher attack complexity because practical exploitation requires reaching the management interface and possessing an old, default, or previously leaked management credential that the operator believed had been superseded; no public exploit has been identified at time of analysis and EPSS is negligible at 0.13% (3rd percentile), and IBM has released a patch.
IBM Verify Identity Access (formerly Security Verify Access) can be driven into a denial-of-service state by a remote, unauthenticated attacker who sends crafted requests that the product fails to validate for resource consumption. Only availability is impacted (CVSS 7.5, C:N/I:N/A:H); confidentiality and integrity are untouched. No public exploit code and no CISA KEV entry were identified in the provided intelligence, and the vendor has published a fix; the practical risk is therefore tied to exposure of the affected endpoints rather than to confirmed active exploitation.
An out-of-bounds write in IBM Verify Identity Access (and its predecessor branding, IBM Security Verify Access, plus both container editions) lets an attacker reach the vulnerability over the network without credentials or user interaction, with the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating full loss of confidentiality, integrity, and availability if the memory-corruption primitive is successfully converted into code execution or a crash. Affected builds are Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001, Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, and the matching Verify Identity Access Container and Security Verify Access Container releases; patched or newer installs are not affected. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV does not list this CVE), and EPSS is low at 0.14 percent (4th percentile), so the practical near-term risk is driven by the product's position on the security perimeter rather than by observed attack activity.
IBM Security Verify Identity Access (formerly Security Verify Access) ships a reverse proxy component that, in certain configurations, performs weaker-than-expected cryptographic validation of user-supplied data. A remote, unauthenticated attacker (CVSS 3.1 AV:N/PR:N/UI:N) can therefore submit crafted data that is improperly validated, exposing protected resources and sensitive identity information; the impact is confidentiality-only (C:H/I:N/A:N) with a base score of 7.5. No CISA KEV entry and no public exploit code were identified at time of analysis, and IBM has published a vendor fix. Affected lines are Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access / Security Verify Access Container 10.0.0 through 10.0.9.2 Interim Fix 001.
IBM Verify Identity Access (and its predecessor Security Verify Access) contains an improper authorization flaw that lets an administrator with limited entitlements execute additional commands beyond their granted privileges by supplying specially crafted input to the product's administrative functionality. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity and availability impact but requiring an existing privileged account to reach. No public exploit code or CISA KEV entry was identified at time of analysis, and IBM has published a vendor fix via its support advisory.
IBM Verify Identity Access and its container edition (versions 11.0.0 through 11.0.3 Interim Fix 001), along with the legacy Security Verify Access and container edition (10.0.0 through 10.0.9.2 Interim Fix 001), fail to properly validate user-supplied management requests, so an administrator whose role is not entitled to certain commands can execute them anyway. The vendor scores this High at CVSS 8.1, but exploitation requires prior access to the administrative/management interface as a role-restricted administrator and a specially crafted request capable of defeating the validation logic, and no public exploit identified at time of analysis (EPSS 0.14%, 4th percentile) exists, while a vendor fix is available.
Unauthenticated remote denial of service in IBM Verify Identity Access (the current name of IBM Security Verify Access) and its container editions, where crafted incoming requests reach a handler that fails to validate resource consumption, leading to uncontrolled recursion (CWE-674) and service exhaustion. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) means any network-reachable instance can be knocked offline without credentials, but confidentiality and integrity are unaffected. IBM has published a vendor fix; no public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided.
IBM Verify Identity Access (formerly IBM Security Verify Access) fails to adequately validate or bound the resources consumed by incoming requests, allowing a remote, unauthenticated attacker to drive resource exhaustion and deny service to legitimate users. Affected builds include Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, in both software and container form factors. IBM has released a fix, EPSS is low at 0.21% (11th percentile), and there is no public exploit identified at time of analysis.
Server-side template injection (SSTI) in IBM Verify Identity Access and Security Verify Access exposes sensitive information to unauthenticated remote attackers via a network-accessible endpoint. The vulnerability affects both traditional appliance deployments and container variants across IBM's IAM product family (versions 10.x and 11.x), and is particularly notable given that IAM platforms routinely handle authentication tokens, user credentials, and security policy configuration - data whose disclosure has outsized downstream impact. IBM has assessed the impact as confidentiality-only (I:N/A:N in the CVSS vector), suggesting the template injection is sandboxed against code execution, but no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege user to assume the identity and privileges of another user by submitting a specially crafted network request. The vulnerability spans both on-premises and container deployments across multiple product generations (10.x and 11.x lines), broadening the exposed surface considerably. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.1 and low attack complexity make this a high-priority patching target for organizations running IBM identity infrastructure.
Privilege escalation via command injection in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated administrator to execute system commands beyond their authorized scope. Affected products span IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the container variant), with network-accessible administrative interfaces as the attack surface. Full confidentiality, integrity, and availability compromise of the underlying system is possible; no public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauthenticated remote attackers via inconsistent HTTP request parsing at the reverse proxy layer. Affected deployments span IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (software and container variants). No public exploit or CISA KEV listing has been identified at time of analysis, but the identity gateway role of this product means a successful bypass could silently undermine authentication enforcement across all downstream resources it protects.
OS command injection in IBM Security Verify Access and IBM Verify Identity Access management interfaces enables already-privileged administrators to execute arbitrary operating system commands beyond their intended scope by submitting crafted HTTP requests to the vulnerable endpoint. Affected deployments span IBM Security Verify Access 10.0-10.0.9.2, IBM Verify Identity Access 11.0-11.0.3, and the containerized variant of the latter - covering both legacy on-premises and modern container-based identity infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the full confidentiality, integrity, and availability impact against identity management infrastructure elevates organizational risk well beyond what the PR:H prerequisite might suggest at face value.
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, including container deployments) enables authenticated administrative attackers to send crafted HTTP requests to the management interface, triggering uncontrolled format string processing. Successful exploitation produces high confidentiality impact through stack memory disclosure and high availability impact through service crashes, with CVSS scope change indicating potential downstream effect on identity services beyond the management component. No public exploit is identified at time of analysis; this is a vendor-confirmed finding reported directly by IBM PSIRT.
Authentication bypass in IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including container deployments) allows network-accessible unauthenticated attackers to circumvent the Reverse Proxy component's cryptographic validation of user-supplied data under certain configurations. The CVSS 7.4 (AV:N/AC:H/PR:N) rating reflects high confidentiality and integrity impact with no privilege requirement, though exploitation depends on specific deployment configurations being active. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a targeted rather than mass-exploitation risk.
Denial of service in IBM Security Verify Access and IBM Verify Identity Access - including container editions - allows remote unauthenticated attackers to crash or indefinitely stall authentication services by triggering an infinite loop (CWE-835). All versions from 10.0 through 10.0.9.2 (Security Verify Access) and 11.0 through 11.0.3 (Verify Identity Access) are affected across both appliance and container deployments. IBM has released a patch; no public exploit code exists and no active exploitation has been recorded by CISA at time of analysis.
Cryptographic validation weakness in the IBM Security Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) allows remote attackers to bypass expected integrity checks on user-supplied data in certain configurations, affecting Security Verify Access 10.0 through 10.0.9.2 and Verify Identity Access (and its Container edition) 11.0 through 11.0.3. NVD rates this CVSS 9.8, but the vague 'certain configurations' wording and a low EPSS of 0.24% (15th percentile) with SSVC exploitation status 'none' point to a config-dependent issue rather than mass exploitation. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Local code execution in IBM Security Verify Access 10.0-10.0.9.1 and 11.0-11.0.2 (both container and non-container deployments) allows unauthenticated local attackers to execute malicious scripts from outside the application's control sphere. This CWE-829 inclusion of functionality from untrusted control sphere vulnerability achieves container escape (scope change to C in CVSS vector), enabling high confidentiality impact and limited integrity/availability impact. No public exploit or active exploitation confirmed at time of analysis, though the low attack complexity (AC:L) and lack of required privileges (PR:N) make this readily exploitable by local users.
Local privilege escalation to root in IBM Verify/Security Verify Access products 10.0-11.0.2 allows unauthenticated local users to gain full system control via excessive process privileges (CWE-250). The CVSS 9.3 score reflects local attack vector but no authentication requirement (PR:N) and complete system compromise with scope change. Patch available per vendor advisory. No public exploit identified at time of analysis, though the local attack vector and low complexity (AC:L) suggest straightforward exploitation once local access is obtained.
Server-Side Request Forgery (SSRF) in IBM Verify Identity Access and Security Verify Access products (versions 10.0-11.0.2) allows unauthenticated remote attackers to contact internal authentication endpoints that should be protected by the Reverse Proxy component. This bypass enables attackers to interact with restricted internal services, potentially leading to unauthorized information disclosure and limited integrity impact. EPSS data not provided, but CVSS 7.2 (High) with network-accessible, low-complexity attack vector indicates moderate real-world risk. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
High-privileged, already-authenticated administrators on the management interface of IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 can forge or tamper with audit log records by injecting argument delimiters into the logging functionality (CWE-88). Because the CVSS vector is PR:H, only an account that already holds elevated privileges on the management console can reach the affected feature, so realistic exposure is confined to insider misuse or an attacker who has already stolen a privileged credential; no user interaction is required and the interface is network-reachable, but impact is limited to audit log integrity with no confidentiality or availability effect. There is no vendor indication of exploitation, and no public exploit identified at time of analysis; severity is low (CVSS 2.7), and a patch is available per the vendor advisory.
SQL injection (CWE-89) in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 allows a remote attacker holding a valid low-privileged session to inject SQL through standard authenticated functionality, enabling unauthorized modification of backend data and partial denial of service. The vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), so confidentiality is not assessed as impacted; the practical barrier is the requirement for credentials, not a special configuration. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and IBM has published a fix via its support portal.
Cross-site scripting (CWE-79) in the Web UI of IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 - including their container editions - lets an attacker inject arbitrary JavaScript into pages rendered by the interface, which can execute in the browser of an authenticated administrator or operator with an active trusted session and potentially disclose credentials or session data. The injection itself requires no authentication (the supplied vector is PR:N), but the payload is only harmful when a victim loads the crafted content (UI:R), so exploitation depends on a successful lure, a poisoned page, or injection into a view the victim already opens. IBM rates this 8.2 (scope changed, high confidentiality and integrity impact); no public exploit code or active exploitation has been identified at time of analysis, though the faulted UI is a high-value administrative target. Note a vector discrepancy: the published CVSS marks AV:L whereas the independent assessment scores AV:N, so defenders should confirm with IBM whether the affected UI is reachable remotely or only from a local/management network, since that materially changes exposure.
Security restriction bypass in IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including their container images, lets a remote attacker who already holds a valid low-privilege session circumvent authentication controls and gain high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Because the vector is PR:L, anonymous or unauthenticated attackers cannot trigger this on their own; the attacker must first possess valid credentials or a session, after which the bypass is low-complexity, requires no user interaction, and is reliably reproducible. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but a vendor patch is available, so the issue should be treated as a credible, above-average-priority fix rather than an emergency.
An authenticated user can exhaust server resources in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including the containerized editions, by submitting a specially crafted HTTP query that triggers uncontrolled resource allocation, resulting in a denial of service (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation requires a valid authenticated session on the affected HTTP interface (PR:L); there is no confidentiality or integrity impact, only availability. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate-priority availability defect rather than a top-tier emergency; vendor patching is available per IBM's advisory.
Authentication workflow bypass in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 allows a remote authenticated attacker who already holds valid first-factor credentials or an active session to skip the configured additional authentication workflow steps - such as step-up authentication, multi-factor prompts, or multi-step policy flows. Rated CVSS 6.5 (moderate), the flaw only affects deployments that actually enforce an additional authentication workflow; environments without one have nothing for the bypass to defeat. Exploitation requires the extra-workflow feature to be configured and the attacker to be a remote authenticated actor, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; note that IBM's supplied CVSS vector (PR:N) contradicts its own 'remote authenticated attacker' description and our independent assessment, which uses PR:L and should be reconciled with the vendor.
A remote, unauthenticated attacker can trigger a limited heap-based out-of-bounds read in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, by sending a specially crafted request to an exposed instance. Successful exploitation is confined to a partial memory read that can cause a denial-of-service condition; there is no confidentiality or integrity impact and no code execution path described. This is a low-severity issue (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) that should be treated as low priority despite its network-facing nature, and at time of analysis no public exploit code and no confirmed active exploitation were identified; a vendor patch is available via IBM support node 7291628.
Authenticated cross-site scripting (XSS) in the local management interface of IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 allows a low-privileged authenticated user to embed arbitrary JavaScript into the Web UI when the deployment is in certain non-default configurations, potentially altering the interface's intended behaviour and disclosing credentials within a trusted session. Exploitation requires an existing account on the management interface (CVSS PR:L) and, in practice, a second trusted user such as an administrator who renders the injected content in their own session; no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is rated low-to-moderate priority - network-reachable but gated by high attack complexity (AC:H) attributable to the configuration prerequisite and by user interaction in the assessed vector.
Cross-site scripting in the IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3) Web UI allows an authenticated user to embed arbitrary JavaScript into a field that is later rendered to another user, so the payload executes within that victim's trusted session (scope change, S:C) and can lead to credential or session disclosure. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4) confirms remote reachability but requires a valid low-privileged account plus victim interaction; there is no availability impact and the exposure is limited to data reachable inside the victim's session. No public exploit code exists and there is no confirmed active exploitation (CISA KEV) at the time of analysis; a vendor patch is available per the IBM advisory.
Parameter injection in the IBM Security Verify Access (Verify Identity Access) reverse proxy - the WebSEAL component - lets unauthenticated, network-reachable attackers have crafted parameters carried into requests the proxy constructs toward back-end or third-party services, potentially manipulating how those downstream services interpret the call. Only deployments below the listed interim-fix levels (Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, plus their container variants) are affected, and realized impact depends heavily on the behaviour of the downstream service, which is why this is scored AC:H with a limited confidentiality but high integrity effect rather than an urgent, broadly weaponizable flaw. There is no public exploit identified at time of analysis and EPSS is only 0.15% (5th percentile), so this is a moderate-priority issue to schedule rather than an emergency; the vendor has published patch guidance.
Missing origin validation in IBM Verify Identity Access and Security Verify Access (including their container editions) lets an unauthenticated, remote attacker ride an authenticated user's live session and carry out operations as that victim, potentially enabling follow-on attacks against the deployment. Exploitation requires the victim - a logged-in Verify Identity Access / Security Verify Access user - to be lured into visiting attacker-controlled web content while their session is active (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, 5.4), so confidentiality and integrity impact is limited to the victim's own privilege scope with no availability loss. No public exploit code has been identified and the flaw is not confirmed actively exploited (CISA KEV); EPSS is 0.15% (4th percentile), and vendor-released fixes are available per IBM's advisory, making this a moderate-severity, likely low-priority issue in real-world terms.
Cross-site scripting (CWE-79) in IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, including the corresponding container editions, allows a remote unauthenticated attacker to run script in the browser of a logged-in user who follows a crafted link, potentially hijacking an authenticated session or performing actions as that user. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which reflects the need for victim interaction and the limited but scope-changing confidentiality and integrity impact typical of reflected XSS. There is no public exploit code identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and the EPSS probability is only 0.20% (10th percentile), so this is a patching-hygiene issue rather than an emergency response item.
An open redirect flaw in IBM Verify Identity Access and Security Verify Access (including their container editions) lets a remote, unauthenticated attacker craft a link pointing at the product's own trusted domain that silently forwards the victim to an attacker-controlled site. Because the URL originates from the legitimate IBM identity provider, the redirect is highly convincing and can be used to harvest credentials or push further phishing stages. IBM has released fixes (Interim Fix 001 for the affected 10.0.0–10.0.9.2 and 11.0.0–11.0.3 streams); there is no public exploit identified at time of analysis, exploitation requires the victim to click a crafted link, and EPSS is very low at 0.19% (9th percentile).
IBM Security Verify Access and IBM Verify Identity Access - across both traditional software and container deployments - expose a Use After Free (CWE-416) memory corruption flaw in the Reverse Proxy component that authenticated network attackers can trigger under certain non-default configurations to cause a denial of service. The vulnerability carries a low CVSS base score of 3.1, reflecting high attack complexity and impact limited strictly to availability, with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis.
Verbose technical error message disclosure in IBM Verify Identity Access and IBM Security Verify Access (both appliance and container editions) allows unauthenticated remote attackers to harvest internal application details returned directly in the browser. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective container variants. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication barrier and the reconnaissance value of exposed technical data elevate this beyond a benign information leak, as harvested details can directly inform more damaging follow-on attacks against an identity management system.
IBM Verify Identity Access and IBM Security Verify Access - both appliance and container deployments - expose an incorrect authorization flaw (CWE-863) that allows an authenticated attacker with read-only privileges to perform unauthorized modifications and deployments outside their assigned permission scope. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective Container variants. A vendor patch is available per IBM advisory 7279510; no public exploit code or CISA KEV listing has been identified at time of analysis.
Open redirect vulnerability in IBM Verify Identity Access and Security Verify Access allows remote unauthenticated attackers to craft malicious URLs that redirect victims to arbitrary attacker-controlled websites, enabling phishing campaigns that exploit the trusted reputation of enterprise IAM infrastructure. Affected deployments span both on-premises and containerized editions across IBM Verify Identity Access 11.0-11.0.2 and IBM Security Verify Access 10.0-10.0.9.1. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7279510.
IBM Security Verify exposes sensitive internal information to unauthenticated remote attackers through overly detailed technical error messages rendered in the browser. Affected deployments span four product variants - IBM Verify Identity Access, IBM Security Verify Access, and their respective container editions - all of which share the same CWE-209 root cause. No public exploit code or CISA KEV listing exists at time of analysis; the primary risk is reconnaissance enablement, where leaked error details lower the effort required for subsequent, more severe attacks.