IBM Security Verify Access: 4 more vulnerabilities disclosed

IBM has disclosed four more vulnerabilities in IBM Security Verify Access and IBM Verify Identity Access. The most serious, which IBM rates critical, lets an authenticated attacker run arbitrary code. The others are an information disclosure flaw, a stack buffer overflow that only an administrator can reach, and a denial-of-service bug. All four are in IBM's October 7 security bulletin, and the CVE records appeared in the National Vulnerability Database on October 8.

Affected versions. IBM lists IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, in both the appliance and container editions. All four flaws affect all of those versions.

The fix. IBM's bulletin says to upgrade appliances to IBM Security Verify Access 10.0.9.3 or IBM Verify Identity Access 11.0.3.1. The bulletin also links updated container downloads. IBM lists no workarounds or mitigations and "encourages customers to update their systems promptly."

The four flaws. IBM and NVD give each of the four a different score, so both are listed.
• CVE-2026-16916: a remote, authenticated attacker could run arbitrary code because of a protection mechanism failure. IBM rates it 9.1 (critical). Its vector requires high privileges and marks the scope as changed. NVD rates it 8.8 (high), scoring it with low privileges and unchanged scope.
• CVE-2026-11888: an information disclosure flaw. IBM's bulletin names the IBM Verify Identity Access Snapshot Manager Container, while the CVE record lists all the versions above. IBM rates it 6.4 (medium). NVD rates it 7.5 (high), scoring it as exploitable with no privileges.

• CVE-2026-12109: an attacker who has administrative privileges and access to the local management interface could run arbitrary code through an unbounded write to a fixed-size stack buffer. IBM rates it 5.5 (medium). NVD rates it 7.2 (high).
• CVE-2026-19498: a remote attacker could cause a denial of service through uncontrolled recursion. IBM rates it 5.9 (medium). NVD rates it 7.5 (high).

About the scores. IBM's scores are CVSS 3.1 base scores from its bulletin and its entries in the CVE records. NVD added its own CVSS 3.1 scores on October 9 after its analysis. Neither IBM's bulletin nor the NVD records report active exploitation.

The wider bulletin. The same IBM bulletin lists 23 CVEs across both products. Among them are two deserialization flaws IBM rates 9.8 (CVE-2026-78401 and CVE-2026-78406) and the authentication bypass CVE-2026-16823, which The Circuitry covered on October 8. IBM gives the same fixed releases for every CVE in the bulletin. Details are in IBM's security bulletin.