CVE-2026-18740

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are affected by an argument-injection flaw (CWE-88). A remote attacker who is already authenticated with low privileges can inject or modify arguments and perform unauthorized actions, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8). The issue is reachable over the network, requires low attack complexity, and needs no user interaction. Organizations running either product in the stated version ranges are affected. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Apply the vendor fix from IBM's advisory for CVE-2026-18740. The supplied data only marks IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 as affected, so upgrade only to a build IBM explicitly states is patched. Until then, restrict network access to these products and limit low-privilege accounts that can reach them, and review logs for unexpected unauthorized actions.