CVE-2026-16916

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a protection-mechanism failure (CWE-693) that can let a remote authenticated attacker run arbitrary code. The attacker must already have high privileges; no user interaction is required, and the CVSS 3.1 vector rates network access with low complexity and a changed scope. Successful exploitation can fully compromise confidentiality, integrity, and availability of the affected system and potentially affect resources beyond it. Organizations running the listed versions of these IBM identity products are affected. The issue is not on the CISA KEV list, and no public proof-of-concept is known.

What to do: Upgrade IBM Security Verify Access to a release newer than 10.0.9.2 and IBM Verify Identity Access to a release newer than 11.0.3, using the fixed builds in IBM's security bulletin. Until then, restrict remote access for high-privilege accounts and review administrative authentication and change logs for unexpected activity.