The vulnerability permits an unauthenticated attacker to run arbitrary operating‑system commands at the level of a low‑privileged user because the product does not properly sanitize user‑supplied input. This is an OS command injection flaw that can allow the attacker to gain unauthorized control over the host, potentially leading to data modification or further lateral movement.

IBM Verify Identity Access versions 11.0 through 11.0.2 and IBM Verify Identity Access Container 11.0 through 11.0.2, as well as IBM Security Verify Access versions 10.0 through 10.0.9.1 and IBM Security Verify Access Container 10.0 through 10.0.9.1, are affected. Patches are available as IBM Verify Identity Access v11.0.2 IF1 and IBM Security Verify Access v10.0.9.1 IF1, which correct the input validation issue.

The CVSS score of 7.3 indicates a high severity while the EPSS score of less than 1 % suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the attack vector is through remote input—such as a web or API endpoint—without authentication, allowing the attacker to trigger the command‑execution flaw.