CVE-2026-11928: Out-of-bounds Write

IBM Verify Identity Access is vulnerable to a buffer overflow attack...

CVE-2026-12101: Authentication Bypass by Alternate Name

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests...

CVE-2026-11921: Insufficiently Protected Credentials

IBM Verify Identity Access containers may not apply management password change operations correctly...

PT-2026-92148

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input...

PT-2026-92154

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-11927: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

PT-2026-92144

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

PT-2026-92149

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests...

PT-2026-92147

IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

PT-2026-92143

IBM Verify Identity Access containers may not apply management password change operations correctly...

CVE-2026-13277

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web si...

CVE-2026-13260

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-13276

IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001 and IBM Verify Identity Access Container 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access Container 10.0.0 through 10.0.9.2 Interim Fix 001...

CVE-2026-13272

IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems...

CVE-2026-13260 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

EUVD-2026-78080

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-13260 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-13260

IBM Verify Identity Access (and IBM Security Verify Access ) is vulnerable to a remote denial of service caused by insufficient validation of incoming request resources. The CISA ADP assessment rates exploitation as none , the vulnerability as automatable , and technical impact as partial . No sp...

EUVD-2026-78074

IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems...

CVE-2026-13272

IBM Verify Identity Access (and IBM Security Verify Access ) is affected by a missing origin validation vulnerability in its WebSockets component. A remote attacker can exploit this to perform operations as the victim, potentially launching further attacks against connected systems. CISA's SSVC a...