IBM Security Verify Access: Cross-site request forgery
Summary
IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including their container editions, are affected by a cross-site request forgery flaw (CWE-352). An attacker can trick a user who is logged in to these products into sending unauthorized requests, which the product accepts as legitimate. The NVD score is 8.8 and requires user interaction; the CNA score listed in research notes is 4.3, and the IBM bulletin excerpt conflicts with the CVE record on CWE and vector, so the severity should be treated as at least medium until IBM confirms it.
Affected
- IBM Security Verify Access 10.0 through 10.0.9.2 (appliance and container)
- IBM Verify Identity Access 11.0 through 11.0.3 (appliance and container)
Fixed in
- Official CVE record download links: IBM Verify Identity Access v11.0.3.1 and IBM Security Verify Access v10.0.9.3 (appliance)
- Newer downloads listed in the IBM bulletin per research notes: Verify Identity Access v11.0.3.2 and Security Verify Access v10.0.9.4
- Container fix: unknown; confirm the current container release with IBM
Workaround
Unknown. No vendor-documented workaround was found.
- Interim, if patching is delayed (general good practice, not IBM guidance): restrict administrative consoles to internal networks and use short session lifetimes.
Exploitation
- No exploitation in the wild found; not listed in KEV according to one tracker.
- No public proof of concept found.
- CISA SSVC: exploitation none, not automatable.
- EPSS score 0.00112 (low).
Our recommendation
- Apply the October 2026 IBM update to the fixed builds (at least 10.0.9.3 or 11.0.3.1; preferably 10.0.9.4 or 11.0.3.2 if confirmed by IBM).
- Confirm the exact fixed build and container fix with IBM before rollout.
- Prioritize internet-facing and administrative instances.
- Ask IBM to confirm the correct CWE, vector and score.
- Until patched, limit admin console access to internal networks and monitor for unexpected administrative actions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin (primary advisory) www.ibm.com
- IBM Security Bulletin (Verify Identity Access 11) www.ibm.com
- Cryptika: IBM patches 22 Verify Access flaws www.cryptika.com
- Cyber Updates: IBM Verify Access 22 vulnerabilities cyberupdates365.com
- Strix: CVE-2026-78388 www.strix.ai
- Vulners: CVE-2026-78388 (Rapid7) vulners.com
- VulDB: CVE-2026-78388 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:07.
Original description (NVD)
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.