Description
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions.
Published: 2026-11-08
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

IBM Security Verify Directory versions 10.0.0 to 10.0.4 and IBM Verify Directory 11.0.0 expose debug endpoints that return system information, including server versions and session identifiers. This allows reconnaissance of the deployed software stack and can aid attackers in selecting further exploitation techniques. The flaw is an information‑exposure weakness (CWE‑200).

Affected Systems

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 are vulnerable. The vendor recommends upgrading to IBM Security Verify Directory v10.0.4.4 or IBM Verify Directory v11.1.2 to remove the exposed debug functionality.

Risk and Exploitability

The CVSS score of 4.3 indicates medium severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, but the exposed debug endpoints can be accessed remotely from the management network. Attackers could use the disclosed data to perform further targeted attacks, making the risk moderate under typical exposure scenarios.

Generated by OpenCVE AI on November 8, 2026 at 20:23 UTC.

Remediation

Vendor Solution

IBM strongly encourages customers to update their systems promptly. Product(s)Affected Version(s)FixIBM Security Verify Directory10.0.0-10.0.4Download and install IBM Security Verify Directory v10.0.4.4 Download document - https://www.ibm.com/support/pages/node/7292855 IBM Verify Directory11.0.0Download and install IBM Verify Directory v11.0.1.2 Download document - https://www.ibm.com/support/pages/node/7290214

OpenCVE Recommended Actions

  • Apply the latest IBM Security Verify Directory patch (v10.0.4.4 or v11.1.2) from the IBM support site.
  • After patching, verify that debug endpoints are disabled or protected by authentication mechanisms.
  • Use firewall or VPN controls to limit accessibility of the management interface to trusted administrators only.

Generated by OpenCVE AI on November 8, 2026 at 20:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 19:00:00 +0000

Type Values Removed Values Added
Description IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions.
Title IBM Verify Directory is affected by multiple vulnerabilities
First Time appeared Ibm
Ibm security Verify Directory
Ibm verify Directory
Weaknesses CWE-200
CPEs cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm security Verify Directory
Ibm verify Directory
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Ibm Security Verify Directory Verify Directory
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-08T18:45:20.654Z

Reserved: 2026-05-14T20:02:22.497Z

Link: CVE-2026-8642

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-08T19:17:42.870

Modified: 2026-11-08T19:17:42.987

Link: CVE-2026-8642

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T20:30:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor