IBM Patches 22 Verify Access Flaws, Including Critical Remote Code Execution Bugs
IBM patched 22 Verify Access flaws, including two unauthenticated CVSS 9.8 remote code execution bugs.
68
CVE-2026-78401
Unauthenticated RCE in IBM Verify Access via deserialization
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 deserialize untrusted data (CWE-502). A remote attacker who can reach the system can trigger that flaw without authentication or user interaction. Successful exploitation yields arbitrary code execution with high impact to confidentiality, integrity, and availability (CVSS 3.1 9.8). Affected systems are deployments of those IBM identity-access products in the stated version ranges. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade IBM Security Verify Access and IBM Verify Identity Access off the affected ranges (10.0 through 10.0.9.2 and 11.0 through 11.0.3) using the vendor fix for CVE-2026-78401. Until patched, do not expose the product to untrusted networks and restrict access to trusted management hosts only.
| Product | Affected |
|---|---|
| IBM Security Verify Access | 10.0 through 10.0.9.2 |
| IBM Verify Identity Access | 11.0 through 11.0.3 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
- Vendors
- ibm
- Products
- security verify access, security verify access container, verify identity access, verify identity access container
- Weakness
- CWE-502
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H