IBM Patches 22 Verify Access Flaws, Including Critical Remote Code Execution Bugs
IBM patched 22 Verify Access flaws, including two unauthenticated CVSS 9.8 remote code execution bugs.
IBM patched 22 vulnerabilities in Security Verify Access and Verify Identity Access, including appliance and container deployments. CVE-2026-78401 and CVE-2026-78406, both CVSS 9.8, are unauthenticated deserialization flaws that can allow remote code execution. Three CVSS 9.1 issues cover privileged code execution, security-restriction bypass, and authentication bypass, with further argument-injection, path-traversal, XSS, SQL injection, CSRF, and denial-of-service fixes. Versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3 are affected; IBM directs customers to 10.0.9.3 or 11.0.3.1 and reports no workarounds or confirmed attacks.
- CVE-2026-78401 and CVE-2026-78406 are CVSS 9.8 unauthenticated deserialization RCE bugs.
- Three additional flaws scored 9.1, including code execution and authentication bypass.
- Affected releases span Security Verify Access 10.0-10.0.9.2 and Identity Access 11.0-11.0.3.
- Fixes are 10.0.9.3 and 11.0.3.1; IBM lists no workarounds.
- The bulletin does not report confirmed exploitation.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-78401 | Unauthenticated RCE in IBM Verify Access via deserialization | 9.8 group max | — |
From the original article
2 min read at cybersecuritynews.com
IBM patched 22 vulnerabilities in Verify Identity Access and Security Verify Access, including two critical flaws allowing unauthenticated remote code execution across appliance and container deployments. The most severe bugs, CVE-2026-78401 and CVE-2026-78406, each carry a CVSS score of 9. 8.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.