CVE-2026-17189
published 2026-10-08CVE-2026-17189: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.15%
3.5th percentile
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | security_verify_access | 10.0 – 10.0.9.2 | — |
| ibm | security_verify_access | >= 10.0.0 < 10.0.9.3 | 10.0.9.3 |
| ibm | security_verify_access_container | 10.0 – 10.0.9.2 | — |
| ibm | security_verify_access_container | 10.0.0.0 – 10.0.9.2 | — |
| ibm | verify_identity_access | >= 11.0 < 11.0.3.1 | 11.0.3.1 |
| ibm | verify_identity_access | 11.0 – 11.0.3 | — |
| ibm | verify_identity_access_container | 11.0 – 11.0.3 | — |
| ibm | verify_identity_access_container | 11.0.0.0 – 11.0.3.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM Security Verify Access/Verify Identity Access cross site scripting
vuldb·2026-10-09·CVSS 8.2
CVE-2026-17189 [HIGH] IBM Security Verify Access/Verify Identity Access cross site scripting
A vulnerability marked as problematic has been reported in IBM Security Verify Access and Verify Identity Access. Affected by this vulnerability is an unknown functionality. This manipulation causes cross site scripting.
This vulnerability is tracked as CVE-2026-17189. The attack is possible to be carried out remotely. No exploit exists.
GHSA
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting.
ghsa_unreviewed·2026-10-08
CVE-2026-17189 [HIGH] CWE-79 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting.
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-08
Published