CVE-2026-12005 - Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

Back Back to CVE browser

HIGH

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

Published Aug 12, 2026

7.2

HIGH

CVSS 3.1

EPSS 0.54%

Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional operations by crafting a malicious HTTP request.

Affected products

Vendor IBM Product Security Verify Access Default
n/a
- Version
  10.0
  Status
  affected
  Constraints
  <=10.0.9.2
Vendor IBM Product Security Verify Access Container Default
n/a
- Version
  10.0
  Status
  affected
  Constraints
  <=10.0.9.2
Vendor IBM Product Verify Identity Access Default
n/a
- Version
  11.0
  Status
  affected
  Constraints
  <=11.0.3
Vendor IBM Product Verify Identity Access Container Default
n/a
- Version
  11.0
  Status
  affected
  Constraints
  <=11.0.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Security Verify Access

n/a

Version	Status	Constraints
10.0	affected	<=10.0.9.2

IBM

Security Verify Access Container

n/a

Version	Status	Constraints
10.0	affected	<=10.0.9.2

IBM

Verify Identity Access

n/a

Version	Status	Constraints
11.0	affected	<=11.0.3

IBM

Verify Identity Access Container

n/a

Version	Status	Constraints
11.0	affected	<=11.0.3

Remediation

Vendor solution

IBM encourages customers to update their systems promptly.

Appliance: Affected Products and Versions Fix availability IBM Verify Identity Access 11.0 - 11.0.3 Download IBM Verify Identity Access v11.0.3 IF1 IBM Security Verify Access 10.0.0 - 10.0.9.2 Download IBM Security Verify Access v10.0.9.2 IF2

Container: Container Download

Weaknesses (1)

CWE-78

OS Command Injection