IBM Patches 22 Verify Access Flaws, Including Critical Remote Code Execution Bugs
IBM patched 22 Verify Access flaws, including two unauthenticated CVSS 9.8 remote code execution bugs.
68
CVE-2026-19491
Authentication Bypass in IBM Security Verify Access
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-19491 is a critical improper-authentication flaw (CWE-287) in IBM Security Verify Access and IBM Verify Identity Access. A remote attacker can bypass authentication over the network with no privileges and no user interaction (CVSS 3.1 base score 9.1). Successful bypass exposes confidentiality and integrity of protected access; availability is not scored as affected. It affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Apply IBM's security update for CVE-2026-19491, moving IBM Security Verify Access past 10.0.9.2 and IBM Verify Identity Access past 11.0.3. Until patched, limit network access to the authentication interfaces to trusted networks and review logs for unexpected successful authentications.
| Product | Affected |
|---|---|
| IBM Security Verify Access | 10.0 through 10.0.9.2 |
| IBM Verify Identity Access | 11.0 through 11.0.3 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.
- Vendors
- ibm
- Products
- security verify access, security verify access container, verify identity access, verify identity access container
- Weakness
- CWE-287
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N