Description
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.
Published: 2026-08-12
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Reverse proxy configurations in IBM Verify Identity Access and IBM Security Verify Access may perform weaker than expected cryptographic validation of user supplied data. This weakness could allow an attacker to tamper with or forge data that is then accepted by downstream components, potentially leading to integrity or authorization bypass. The vulnerability is a weakness relating to cryptographic mechanisms.

Affected Systems

IBM Security Verify Access versions 10.0.0 through 10.0.9.2 and their container editions, and IBM Verify Identity Access versions 11.0.0 through 11.0.3 and their container editions are affected. The applicable fixes are the 10.0.9.2 IF2 release for Security Verify Access and the 11.0.3 IF1 release for Verify Identity Access.

Risk and Exploitability

The CVSS score of 6.8 indicates a medium severity risk. EPSS is not available, so no current exploitation probability is reported, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via the reverse proxy over a network, as inferred from the description. Formal exploit evidence is not documented in the provided data.

Generated by OpenCVE AI on August 12, 2026 at 22:32 UTC.

Remediation

Vendor Solution

IBM encourages customers to update their systems promptly. Appliance: Affected Products and Versions Fix availability IBM Verify Identity Access 11.0 - 11.0.3 Download IBM Verify Identity Access v11.0.3 IF1 IBM Security Verify Access 10.0.0 - 10.0.9.2 Download IBM Security Verify Access v10.0.9.2 IF2 Container: Container Download

OpenCVE Recommended Actions

  • Apply the IBM Verify Identity Access v11.0.3 IF1 patch or upgrade to a later release and apply the IBM Security Verify Access v10.0.9.2 IF2 patch or upgrade to a later release, as recommended by IBM.
  • Configure the reverse proxy to use only strong cipher suites and enforce up‑to‑date TLS protocols, which mitigates the weak cryptographic validation weakness identified as CWE‑310.
  • If an update cannot be applied immediately, restrict access to the reverse proxy from trusted sources only and monitor for anomalous traffic patterns that may indicate attempts to exploit cryptographic validation weaknesses.

Generated by OpenCVE AI on August 12, 2026 at 22:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0.9.2:-:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0.9.2:interim_fix1:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0.3:-:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:*:*:*:*:*:*:*:*

Wed, 12 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.
Title Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
First Time appeared Ibm
Ibm security Verify Access
Ibm security Verify Access Container
Ibm verify Identity Access
Ibm verify Identity Access Container
Weaknesses CWE-310
CPEs cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm security Verify Access
Ibm security Verify Access Container
Ibm verify Identity Access
Ibm verify Identity Access Container
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Ibm Security Verify Access Security Verify Access Container Verify Identity Access Verify Identity Access Container
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-12T20:53:53.970Z

Reserved: 2026-07-27T20:17:04.824Z

Link: CVE-2026-17616

cve-icon Vulnrichment

Updated: 2026-08-12T20:33:08.583Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-12T21:17:36.663

Modified: 2026-08-17T17:23:49.830

Link: CVE-2026-17616

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T22:45:10Z

Weaknesses