IBM Security Verify Access: Argument injection leads to command execution
Summary
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, contain an argument injection flaw (CWE-88). A remote attacker with a valid low-privilege account can execute arbitrary operating system commands on the system. No user interaction is required, and the CVSS base score is 8.8.
Affected
- IBM Security Verify Access 10.0 through 10.0.9.2
- IBM Verify Identity Access 11.0 through 11.0.3
- IBM Security Verify Access Container 10.0 through 10.0.9.2
- IBM Verify Identity Access Container 11.0 through 11.0.3
Fixed in
- Appliance: IBM Security Verify Access 10.0.9.3 (per secondary reporting)
- Appliance: IBM Verify Identity Access 11.0.3.1 (per secondary reporting)
- Container: Unknown.
Workaround
No workaround documented. Applying the fix is the only documented remedy.
Exploitation
- No known exploitation in the wild found at the time of research.
- No public proof-of-concept exploit found at the time of research.
- Not listed in CISA KEV.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Inventory all Security Verify Access and Verify Identity Access appliances and containers, and record exact versions.
- Patch appliances to 10.0.9.3 or 11.0.3.1, or the level specified on IBM's advisory page. Verify the target version on IBM's page first. Check container images separately.
- Restrict management and administrative interfaces to internal networks and review low-privilege accounts for necessity.
- Monitor for unusual command or process activity on the appliance and for new or unexpected logins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin (linked advisory page) www.ibm.com
- IBM Security Bulletin listing CVE-2026-19482 www.ibm.com
- CyberUpdates365: IBM Verify Access vulnerabilities cyberupdates365.com
- SecurityOnline: IBM Verify Access vulnerabilities securityonline.info
- VulDB: CVE-2026-19482 vuldb.com
- Strix: CVE-2026-19482 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:11.
Original description (NVD)
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.