CVE-2026-16823

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 have an improper authentication flaw (CWE-287) that can let a remote attacker bypass security restrictions. The issue is reachable over the network with no privileges required and no user interaction, and it is rated CVSS 3.1 9.1. A successful bypass can disclose confidential information and allow unauthorized changes, with no direct availability impact. Organizations running those version ranges of IBM’s enterprise access-management products are affected. No public proof-of-concept is known, and the CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog.

What to do: Apply the IBM security update that fixes CVE-2026-16823 for IBM Security Verify Access releases through 10.0.9.2 and IBM Verify Identity Access releases through 11.0.3; do not assume a specific later build number until IBM’s bulletin names it. Until the fix is installed, restrict network access to the product’s authentication and administration interfaces to trusted networks and review authentication logs for unexpected remote access.