IBM Verify Access Critical Flaws Allow Admin Access and Code Execution

CERT-Bund Security Advisories

Published March 31st, 2026

Detected April 1st, 2026

Summary

CERT-Bund issued advisory WID-SEC-2026-0949 identifying multiple critical vulnerabilities in IBM Security Verify Access (versions prior to 10.0.9.1 IF1) with a CVSS Base Score of 9.8. The flaws allow remote attackers to gain administrator privileges, execute arbitrary code, bypass security controls, perform cross-site scripting attacks, and modify or disclose data. A mitigation is available.

View original document View source feed page

What changed

CERT-Bund disclosed critical vulnerabilities in IBM Security Verify Access affecting versions below 10.0.9.1 IF1 across UNIX, Windows, and other platforms. The vulnerabilities carry a CVSS Base Score of 9.8 (Critical) and Temporal Score of 8.5 (High), enabling complete system compromise through administrator privilege escalation and arbitrary code execution.

Organizations using IBM Security Verify Access must immediately verify their installed version and apply available mitigations or patches. Given the critical severity and remote attack vector, affected entities should treat this as a priority security incident and implement remediation without delay.

What to do next

Identify all deployments of IBM Security Verify Access in the environment and verify current version numbers
Upgrade to version 10.0.9.1 IF1 or later immediately if running an affected version
Review access logs for signs of exploitation given the critical severity and availability of remote attacks

Source document (simplified)

[WID-SEC-2026-0949] IBM Security Verify Access: Mehrere Schwachstellen CVSS Base Score 9.8 (kritisch) CVSS Temporal Score 8.5 (hoch) Remoteangriff ja Datum 31.03.2026 Stand 01.04.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

Sonstiges
UNIX
Windows

Produktbeschreibung

IBM Security Verify Access, ehemals IBM Security Access Manager (ISAM), ist eine Zugriffsverwaltungslösung.

Produkte

31.03.2026
- IBM Security Verify Access <10.0.9.1 IF1

Angriff

Ein Angreifer kann mehrere Schwachstellen in IBM Security Verify Access ausnutzen, um Administratorrechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen sowie Daten zu verändern oder offenzulegen. CVE Informationen Versionshistorie Feedback zum Advisory geben