Hard‑coded credentials used in IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 allow a physically proximate attacker to gain elevated privileges. This flaw can enable unauthorized administrative access, allowing the attacker to modify configuration, access sensitive data, or disrupt services. The weakness corresponds to CWE‑798, where fixed credentials compromise security.

Affected products are IBM Verify Identity Access version 11.0.3.1 and IBM Security Verify Access version 10.0.9.3. IBM provides patches that upgrade these appliances to 11.0.3.2 and 10.0.9.4 respectively, effectively removing the hard‑coded credentials. Only appliances running these older releases are vulnerable; newer releases are not impacted.

The CVSS score of 8.8 indicates high severity, and although no EPSS score is available, the lack of listing in the CISA KEV catalog suggests no publicly known exploitation yet. Nevertheless, the attack requires physical proximity to the appliance or local network connectivity, making the vulnerability most dangerous to facilities with inadequate physical security. If unpatched, an attacker could elevate privileges to full administrative control, compromising confidentiality, integrity, and availability of the managed identities.