CVE-2026-19482

CVE-2026-19482 is an authenticated command-injection flaw (CWE-88) in IBM Security Verify Access and IBM Verify Identity Access caused by improper neutralization of command arguments. A remote attacker who already has low-privilege credentials can send crafted input over the network, with no user interaction, and cause the product to run arbitrary commands. Successful exploitation yields high impact to confidentiality, integrity, and availability of the affected system (CVSS 3.1 base score 8.8). It affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3. The issue is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Apply IBM's fix for releases newer than the affected ranges (Security Verify Access 10.0 through 10.0.9.2 and Verify Identity Access 11.0 through 11.0.3); do not assume a specific build number that is not in IBM's bulletin. Until patched, limit which low-privilege accounts can reach administrative or command-handling functions and restrict network access to those interfaces. Review logs for unexpected command execution from authenticated sessions.