CVE-2026-78401
published 2026-10-08CVE-2026-78401: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute…
PriorityP268critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.78%
55.7th percentile
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | security_verify_access | 10.0 – 10.0.9.2 | — |
| ibm | security_verify_access | >= 10.0.0 < 10.0.9.3 | 10.0.9.3 |
| ibm | security_verify_access_container | 10.0 – 10.0.9.2 | — |
| ibm | security_verify_access_container | 10.0.0.0 – 10.0.9.2 | — |
| ibm | verify_identity_access | >= 11.0 < 11.0.3.1 | 11.0.3.1 |
| ibm | verify_identity_access | 11.0 – 11.0.3 | — |
| ibm | verify_identity_access_container | 11.0 – 11.0.3 | — |
| ibm | verify_identity_access_container | 11.0.0.0 – 11.0.3.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM Security Verify Access/Verify Identity Access up to 10.0.9.2/11.0.3 deserialization
vuldb·2026-10-09·CVSS 9.8
CVE-2026-78401 [CRITICAL] IBM Security Verify Access/Verify Identity Access up to 10.0.9.2/11.0.3 deserialization
A vulnerability, which was classified as very critical, was found in IBM Security Verify Access and Verify Identity Access up to 10.0.9.2/11.0.3. Impacted is an unknown function. The manipulation results in deserialization.
This vulnerability is reported as CVE-2026-78401. The attack can be launched remotely. No exploit exists.
GHSA
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the des
ghsa_unreviewed·2026-10-08
CVE-2026-78401 [CRITICAL] CWE-502 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the des
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
No detection rules found.
No public exploits indexed.
2026-10-08
Published