Description
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session
Published: 2026-10-08
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Credential Theft
Action: Apply Patch
AI Analysis

Impact

This vulnerability is a cross‑site scripting flaw that allows an unauthenticated user to inject arbitrary JavaScript into the Web UI. The injection can alter page functionality and, within a trusted session, may lead to the disclosure of user credentials or the hijack of session tokens.

Affected Systems

Affected products are IBM Verify Identity Access and IBM Security Verify Access, including their container variants. Vulnerable versions include Verify Identity Access 11.0.0 through 11.0.3 and Security Verify Access 10.0.0 through 10.0.9.2; updates are available in Verify Identity Access v11.0.3.1 and Security Verify Access v10.0.9.3.

Risk and Exploitability

The CVSS score is 8.2, indicating a high risk to confidentiality and availability. EPSS is not available, and the issue is not listed in CISA KEV, suggesting no confirmed widespread exploitation. Attack vectors are likely web‑based; an attacker does not need authentication to inject script, making exploitation straightforward if the UI endpoint is reachable.

Generated by OpenCVE AI on October 8, 2026 at 22:44 UTC.

Remediation

Vendor Solution

IBM encourages customers to update their systems promptly. Appliance: Affected Products Fix availability IBM Verify Identity Access Download IBM Verify Identity Access v11.0.3.1 IBM Security Verify Access Download IBM Security Verify Access v10.0.9.3 Container: Container Download

OpenCVE Recommended Actions

  • Download and install IBM Verify Identity Access v11.0.3.1 or later, ensuring the fix is applied.
  • Download and install IBM Security Verify Access v10.0.9.3 or later to replace vulnerable versions.
  • Update any deployed Verify Identity Access or Security Verify Access container images to the latest released versions.
  • If the patch cannot be applied immediately, restrict or remove the vulnerable UI endpoints and apply strict input validation and output encoding for all user‑controlled data, mitigating CWE‑79 injection attacks.
  • As a temporary countermeasure, deploy a web application firewall rule to block or sanitize injected JavaScript before it reaches the browser.

Generated by OpenCVE AI on October 8, 2026 at 22:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:*:*:*:*:*:*:*:*

Thu, 08 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Description IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session
Title Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
First Time appeared Ibm
Ibm security Verify Access
Ibm security Verify Access Container
Ibm verify Identity Access
Ibm verify Identity Access Container
Weaknesses CWE-79
CPEs cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm security Verify Access
Ibm security Verify Access Container
Ibm verify Identity Access
Ibm verify Identity Access Container
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N'}

Subscriptions

Ibm Security Verify Access Security Verify Access Container Verify Identity Access Verify Identity Access Container
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-13T13:48:38.825Z

Reserved: 2026-07-24T19:00:41.484Z

Link: CVE-2026-17189

cve-icon Vulnrichment

Updated: 2026-10-13T13:48:17.567Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T21:17:56.633

Modified: 2026-10-13T14:17:36.777

Link: CVE-2026-17189

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T22:45:07Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')