The vulnerability in IBM Verify Identity Access (v11.0.0–11.0.3) and IBM Security Verify Access (v10.0.0–10.0.9.2) permits a remote, authenticated attacker to execute arbitrary code due to a protection‑mechanism failure. An attacker who authenticates to the affected system can run code with the privileges of the application, potentially leading to full compromise of the host. The flaw is mapped to CWE‑693 and is rated with a CVSS of 9.1, signifying critical impact on confidentiality, integrity, and availability.

The affected products are IBM: Security Verify Access, IBM: Security Verify Access Container, IBM: Verify Identity Access, and IBM: Verify Identity Access Container. Versions from 10.0.0 through 10.0.9.2 of Security Verify Access and from 11.0.0 through 11.0.3 of Verify Identity Access are vulnerable. IBM recommends updating to Security Verify Access v10.0.9.3 and Verify Identity Access v11.0.3.1; container deployments should also apply the corresponding container image updates.

This flaw has a CVSS base score of 9.1 and is not listed in the CISA KEV catalog. The EPSS score is not available, so the exploitation likelihood is uncertain, but the high severity and remote authenticated nature suggest a significant risk for organizations that have exposed these services to external users. Attackers would need valid credentials, so mitigations that compromise authentication or limit access are effective until patches are applied.