IBM Patches 22 Critical Vulnerabilities in Verify Access

Key Takeaways

• IBM has released patches for 22 security vulnerabilities impacting its Verify Identity Access and Security Verify Access products.
• Two critical flaws (CVE-2026-78401, CVE-2026-78406) with CVSS scores of 9.8 allow unauthenticated remote code execution.
• The affected versions span IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3.
• Customers are urged to update to Verify Identity Access 11.0.3.1 or Security Verify Access 10.0.9.3 immediately.

IBM Addresses Critical Vulnerabilities in Verify Access Products

IBM has issued a significant security update, patching 22 vulnerabilities across its Verify Identity Access and Security Verify Access platforms. This comprehensive patch release includes two critical flaws that could enable unauthenticated remote code execution in both appliance and container deployments of the affected products.

High-Severity Deserialization Flaws

The most severe issues, identified as CVE-2026-78401 and CVE-2026-78406, each received a CVSS v3 score of 9.8. Both vulnerabilities stem from insecure deserialization of untrusted data, a common weakness where software reconstructs data objects without adequate validation of their integrity or origin. This oversight can allow malicious data to be processed, leading to arbitrary code execution.

According to the public advisory, CVE-2026-78401 specifically confirms the risk of unauthenticated remote code execution. IBM categorizes both deserialization bugs as network-accessible with low attack complexity, requiring no special privileges or user interaction from the victim. Successful exploitation of these flaws could severely compromise the confidentiality, integrity, and availability of data and services. However, the provided bulletin does not detail specific vulnerable endpoints, describe an exploit chain, or report any confirmed instances of these vulnerabilities being exploited in the wild.

These critical vulnerabilities demand immediate attention from administrators, primarily because they do not require a valid user account for attackers to reach the vulnerable code. Their high severity reflects the potential impact and ease of exploitation, not an indication that active attacks have been observed.

Additional High-Impact Vulnerabilities

Beyond the critical deserialization flaws, the update addresses three other vulnerabilities with CVSS scores of 9.1. CVE-2026-16916 allows a highly privileged, authenticated remote attacker to execute arbitrary code due to a lapse in a protection mechanism. CVE-2026-16823 facilitates the bypass of security restrictions, while CVE-2026-19491 enables authentication bypass. Unlike the deserialization issues, these vulnerabilities necessitate different access levels and present distinct attack outcomes.

The bulletin also addresses CVE-2026-18740 and CVE-2026-19482, both rated 8.8. These argument injection vulnerabilities could allow authenticated remote attackers to perform unauthorized actions or execute arbitrary commands. Additionally, CVE-2026-19493, with a score of 7.5, presents a path traversal vulnerability that could allow remote attackers to write files to arbitrary locations.

Further vulnerabilities patched include several cross-site scripting (XSS) issues that could expose credentials within trusted sessions, SQL injection flaws that could lead to data modification or service disruption, and cross-site request forgery (CSRF) vulnerabilities capable of triggering unauthorized actions. Other fixes address audit log forgery, incorrect authorization checks, authentication workflow bypasses, and information disclosure in the Snapshot Manager Container. Several denial-of-service (DoS) vulnerabilities related to resource allocation, recursive processing, and memory reads were also resolved. A stack buffer write issue requiring administrative privileges and local management interface access was also corrected.

Affected Versions and Remediation

The vulnerabilities impact IBM Security Verify Access and its Container edition, specifically versions 10.0 through 10.0.9.2. IBM Verify Identity Access and its Container edition are affected from versions 11.0 through 11.0.3. IBM notes that Security Verify Access was rebranded as Verify Identity Access starting with version 11.0.0.

For appliance customers, IBM recommends installing Verify Identity Access 11.0.3.1 or Security Verify Access 10.0.9.3, available via its Fix Central download links. Container users should consult IBM’s container download guidance for specific product images and registry locations. The bulletin does not provide any workarounds or mitigations, emphasizing that customers should promptly apply the supplied fixes as the definitive remediation for these vulnerabilities across all supported deployments.

What You Should Do

• Immediate Patching: Prioritize the installation of the latest patches. Appliance users should update to Verify Identity Access 11.0.3.1 or Security Verify Access 10.0.9.3.
• Container Updates: For container deployments, follow IBM’s official container download guidance to ensure the correct patched images are deployed.
• Review Access Controls: While these critical flaws are unauthenticated, regularly review and strengthen access controls and network segmentation to limit potential lateral movement in case of a breach.
• Monitor Systems: Enhance monitoring for unusual activity, especially around Verify Access instances, to detect any potential exploitation attempts.
• Stay Informed: Regularly check IBM’s security advisories and support pages for any further updates or emerging threats related to Verify Access products.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.