CVE-2026-12004
published 2026-08-12CVE-2026-12004: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through…
PriorityP347high8.7CVSS 3.1
AVNACLPRHUINSCCHINAH
EPSS
0.35%
28.4th percentile
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | security_verify_access | — | — |
| ibm | security_verify_access | 10.0 – 10.0.9.2 | — |
| ibm | security_verify_access | 10.0.0 – 10.0.9.2 | — |
| ibm | security_verify_access_container | 10.0 – 10.0.9.2 | — |
| ibm | verify_identity_access | 11.0 – 11.0.3 | — |
| ibm | verify_identity_access_container | 11.0 – 11.0.3 | — |
| ibm | verify_identity_access_container | 11.0.0.0 – 11.0.3.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM Security Verify Access Management Interface format string
vuldb·2026-08-12·CVSS 8.7
CVE-2026-12004 [HIGH] IBM Security Verify Access Management Interface format string
A vulnerability labeled as critical has been found in IBM Security Verify Access, Security Verify Access Container and Verify Identity Access. Affected by this vulnerability is an unknown functionality of the component Management Interface. Executing a manipulation can lead to format string.
The identification of this vulnerability is CVE-2026-12004. The attack may be launched remotely. There is no exploit available.
GHSA
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vuln
ghsa_unreviewed·2026-08-12
CVE-2026-12004 [HIGH] CWE-134 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vuln
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-12
Published