IBM Verify Identity Access: Hard-coded credentials allow privilege escalation
Summary
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance contain hard-coded credentials (CWE-798). An attacker with physical or adjacent access can use them to gain elevated privileges. Because these identity and access management appliances control authentication for connected systems, a successful attack could affect confidentiality, integrity and availability across the environment. Exploitation requires no user interaction and only low complexity, but the attack vector is inconsistently described in the sources.
Affected
- IBM Verify Identity Access 11.0.3.1 (appliance)
- IBM Security Verify Access 10.0.9.3 (appliance)
- Whether earlier versions or container builds are affected: Unknown.
Fixed in
- IBM Verify Identity Access: upgrade to 11.0.3.2
- IBM Security Verify Access: upgrade to 10.0.9.4
- Confirm the fix versions on the IBM Security Bulletin before deployment.
Workaround
- No workaround is documented by IBM (Workarounds and Mitigations: None).
- Whether the hard-coded credentials can be changed by the customer before patching: Unknown.
Exploitation
- Not known to be exploited (CISA SSVC: Exploitation none; not listed in KEV according to available sources).
- No public exploit or proof of concept known.
- Automatable: no.
Our recommendation
- Inventory all Verify Access and Verify Identity Access appliances and containers.
- Confirm physical and local access controls on each appliance and restrict access to authorised staff.
- Schedule the upgrade to 11.0.3.2 or 10.0.9.4 as soon as possible.
- Rotate administrative credentials after patching and disable unused accounts.
- Monitor for unexpected administrative logins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7292606 www.ibm.com
- VulDB CVE-2026-109126 vuldb.com
- OpenCVE CVE-2026-109126 app.opencve.io
- Strix CVE-2026-109126 www.strix.ai
- Hol.org CVE-2026-109126 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:42.
Original description (NVD)
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.