Description
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability.
Published: 2026-10-08
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Tampering
Action: Patch Now
AI Analysis

Impact

A SQL injection flaw exists in IBM Verify Identity Access and IBM Security Verify Access that allows a remote authenticated user to execute arbitrary SQL commands. The flaw can lead to unauthorized modification of stored data and can also trigger a denial‑of‑service condition when the injected queries overwhelm the application. This weakness is identified as CWE‑89.

Affected Systems

Affected versions include IBM Verify Identity Access 11.0 through 11.0.3 and IBM Security Verify Access 10.0 through 10.0.9.2. The issue applies to both the standard appliance releases and their respective container images.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.4, which indicates a moderate impact. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Attack vectors are remote but require authentication; the attacker must possess valid credentials before exploitation can occur. Because the flaw relies on authenticated access, the likelihood of exploitation depends on credential exposure and is therefore considered moderate.

Generated by OpenCVE AI on October 8, 2026 at 22:43 UTC.

Remediation

Vendor Solution

IBM encourages customers to update their systems promptly. Appliance: Affected Products Fix availability IBM Verify Identity Access Download IBM Verify Identity Access v11.0.3.1 IBM Security Verify Access Download IBM Security Verify Access v10.0.9.3 Container: Container Download

OpenCVE Recommended Actions

  • Upgrade IBM Verify Identity Access to version 11.0.3.1 and IBM Security Verify Access to version 10.0.9.3 as recommended by IBM.
  • Ensure the database account used by Verify Access has only the minimum permissions required for its operation, reducing the potential impact of any successful injection.
  • Monitor application and database logs for anomalous SQL query patterns and implement web‑application‑firewall rules that block suspicious SQL syntax.

Generated by OpenCVE AI on October 8, 2026 at 22:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:*:*:*:*:*:*:*:*

Thu, 08 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Description IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability.
Title Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
First Time appeared Ibm
Ibm security Verify Access
Ibm security Verify Access Container
Ibm verify Identity Access
Ibm verify Identity Access Container
Weaknesses CWE-89
CPEs cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm security Verify Access
Ibm security Verify Access Container
Ibm verify Identity Access
Ibm verify Identity Access Container
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Ibm Security Verify Access Security Verify Access Container Verify Identity Access Verify Identity Access Container
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-12T22:54:02.384Z

Reserved: 2026-07-24T02:30:44.869Z

Link: CVE-2026-16830

cve-icon Vulnrichment

Updated: 2026-10-12T22:53:00.599Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T21:17:56.370

Modified: 2026-10-12T23:17:36.300

Link: CVE-2026-16830

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T23:15:13Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')