Description
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
Published: 2026-10-08
Score: 9.8 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises from the deserialization of untrusted data, allowing a remote unauthenticated attacker to execute arbitrary code on the system. It is a classic deserialization flaw identified as CWE-502, which can compromise confidentiality, integrity, and availability of the affected services.

Affected Systems

Affected IBM products include IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3, as well as their corresponding container-enabled editions. IBM has released patches: IBM Verify Identity Access v11.0.3.1 and IBM Security Verify Access v10.0.9.3.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity. With no EPSS data available and the vulnerability not listed in the CISA KEV catalog, the nominal exploit probability is unknown, but the remote nature and power to run code make this a high‑risk issue. An attacker can send a crafted serialized payload over an unauthenticated channel to exploit the flaw.

Generated by OpenCVE AI on October 8, 2026 at 22:49 UTC.

Remediation

Vendor Solution

IBM encourages customers to update their systems promptly. Appliance: Affected Products Fix availability IBM Verify Identity Access Download IBM Verify Identity Access v11.0.3.1 IBM Security Verify Access Download IBM Security Verify Access v10.0.9.3 Container: Container Download

OpenCVE Recommended Actions

  • Update to IBM Verify Identity Access v11.0.3.1 or later
  • Update to IBM Security Verify Access v10.0.9.3 or later
  • If a patch cannot be applied immediately, limit external access to the affected endpoints so only trusted IP addresses can reach the services, effectively blocking unauthenticated remote exploitation

Generated by OpenCVE AI on October 8, 2026 at 22:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Description IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
Title Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
First Time appeared Ibm
Ibm security Verify Access
Ibm security Verify Access Container
Ibm verify Identity Access
Ibm verify Identity Access Container
Weaknesses CWE-502
CPEs cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm security Verify Access
Ibm security Verify Access Container
Ibm verify Identity Access
Ibm verify Identity Access Container
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Security Verify Access Security Verify Access Container Verify Identity Access Verify Identity Access Container
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-09T11:53:45.510Z

Reserved: 2026-08-24T14:22:42.606Z

Link: CVE-2026-78406

cve-icon Vulnrichment

Updated: 2026-10-09T11:53:06.335Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-10-08T21:18:03.190

Modified: 2026-10-09T12:17:11.860

Link: CVE-2026-78406

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T23:15:13Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data