CVE-2026-19493

IBM Security Verify Access and IBM Verify Identity Access contain a path-traversal flaw (CWE-22) that allows a remote attacker to write arbitrary files. The issue is reachable over the network with no authentication and no user interaction (CVSS 3.1 7.5), with high integrity impact and no confidentiality or availability impact scored. An attacker who can reach a vulnerable instance could overwrite files the service is able to write, which may corrupt configuration or other application data. Affected ranges are IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3. No public proof of concept is known and the CVE is not in CISA KEV, so exploitation is none known.

What to do: Install IBM fixes for releases newer than IBM Security Verify Access 10.0.9.2 and IBM Verify Identity Access 11.0.3 per the vendor bulletin; do not treat any unstated version as fixed. Until patched, limit network access to the product to trusted networks and review logs and writable paths for unexpected file writes.