CVE-2026-78406

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a critical deserialization flaw (CWE-502) that lets a remote unauthenticated attacker run arbitrary code. The issue is triggered when the product deserializes untrusted data, and it requires no privileges and no user interaction (CVSS 3.1 9.8). Successful exploitation gives the attacker full confidentiality, integrity, and availability impact on the affected system. Organizations running either product in the stated version ranges are affected. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof of concept is known.

What to do: Upgrade IBM Security Verify Access to a release newer than 10.0.9.2 and IBM Verify Identity Access to a release newer than 11.0.3, using the fixed builds named in IBM's security bulletin. Until then, do not expose these systems to untrusted networks and limit access to trusted management networks only. No public proof of concept or confirmed in-the-wild exploitation is known, but the flaw is remotely exploitable without authentication and should be patched urgently.