A local authenticated user of IBM Verify Identity Access or IBM Security Verify Access can raise privileges to root because the system runs components with higher privileges than required. This violates least privilege (CWE-250) and allows an attacker to modify configuration, install persistence, and take full control of the host, compromising confidentiality, integrity and availability.

Installations of IBM Verify Identity Access 11.0, 11.0.1, 11.0.2 and its container image, as well as IBM Security Verify Access 10.0, 10.0.1…10.0.9.1 and its container image are affected. All customers deploying these products in either on‑premise or container environments are at risk.

The vulnerability scores 9.3 on CVSS v3.1, indicating critical severity, while the EPSS score is below 1% and it is not listed in the CISA KEV catalog. Exploitation requires local authentication and knowledge of the product. An attacker would need physical or remote access that permits a local login. The absence of a remote attack vector reduces spread but does not eliminate risk in environments where local access is compromised.