Ibm Security Verify Access vulnerabilities

CVE-2026-1345 [HIGH] CWE-78 CVE-2026-1345: IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10 IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow an unauthenticated user to execute arbitrary commands as lower user privileges on the system due to improper validation

CVE-2025-36354 [HIGH] CWE-78 CVE-2025-36354: IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0. IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input.

CVE-2026-12004 [HIGH] CWE-134 CVE-2026-12004: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request.

CVE-2021-20533 [HIGH] CVE-2021-20533: IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbi IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 198813

CVE-2026-11923 [HIGH] CWE-287 CVE-2026-11923: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.

CVE-2026-12005 [HIGH] CWE-78 CVE-2026-12005: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional operations by crafting a malicious HTTP request.

CVE-2026-11934 [HIGH] CWE-285 CVE-2026-11934: IBM Verify Identity Access could allow an administrator to execute additional commands they are not IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.

CVE-2026-1346 [HIGH] CWE-250 CVE-2026-1346: IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10 IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow a locally authenticated user to escalate their privileges to root due to execution with unnecessary privileges than req

CVE-2026-12618 [HIGH] CWE-74 CVE-2026-12618: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.

CVE-2025-36355 [HIGH] CWE-829 CVE-2025-36355: IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0. IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated user to execute malicious scripts from outside of its control sphere.

CVE-2024-31873 [HIGH] CWE-798 CVE-2024-31873: IBM Security Verify Access Appliance 10.0.0 through 10.0.7 contains hard-coded credentials which it IBM Security Verify Access Appliance 10.0.0 through 10.0.7 contains hard-coded credentials which it uses for its own inbound authentication that could be obtained by a malicious actor. IBM X-Force ID: 287317.

CVE-2026-1342 [HIGH] CWE-829 CVE-2026-1342: IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10 IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow a locally authenticated user to execute malicious scripts from outside of its control sphere.

CVE-2026-13297 [HIGH] CWE-1336 CVE-2026-13297: IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure at IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack.

CVE-2024-31871 [HIGH] CWE-295 CVE-2024-31871: IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Python scripts due to improper certificate validation. IBM X-Force ID: 287306.

CVE-2024-31872 [HIGH] CWE-295 CVE-2024-31872: IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Open Source scripts due to missing certificate validation. IBM X-Force ID: 287316.

CVE-2021-29665 [HIGH] CWE-787 CVE-2021-29665: IBM Security Verify Access 20.07 is vulnerable to a stack based buffer overflow, caused by improper IBM Security Verify Access 20.07 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with elevated privileges.

CVE-2023-25927 [HIGH] CWE-20 CVE-2023-25927: IBM Security Verify Access 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, and 10.0.5 could allow an attacke IBM Security Verify Access 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, and 10.0.5 could allow an attacker to crash the webseald process using specially crafted HTTP requests resulting in loss of access to the system. IBM X-Force ID: 247635.

CVE-2023-43016 [HIGH] CWE-258 CVE-2023-43016: IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6. IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote user to log into the server due to a user account with an empty password. IBM X-Force ID: 266154.

CVE-2026-11929 [HIGH] CWE-327 CVE-2026-11929: IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.

CVE-2026-1343 [HIGH] CWE-918 CVE-2026-1343: IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10 IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 allows an attacker to contact internal authentication endpoints which are protected by the Reverse Proxy.