IBM Security Verify Access: Remote code execution via deserialization
Summary
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, deserialize untrusted data. A remote, unauthenticated attacker can send crafted input and execute arbitrary code on the system without user interaction. The CVSS score is 9.8 (critical), and internet-reachable instances carry the highest risk.
Affected
- IBM Security Verify Access 10.0 through 10.0.9.2 (appliance and container)
- IBM Verify Identity Access 11.0 through 11.0.3 (appliance and container)
Fixed in
- IBM Verify Identity Access 11.0.3.1 (appliance, per IBM download list in the CVE record)
- IBM Security Verify Access 10.0.9.3 (appliance, per IBM download list in the CVE record)
- Container fix version: Unknown.
- Note: some secondary reports cite 11.0.3.2 and 10.0.9.4. These are unconfirmed; verify against IBM's bulletin.
Workaround
Unknown. No vendor-published workaround found.
- Unverified third-party guidance: restrict access to management and service endpoints to trusted networks and disable non-essential remote administration until patched.
Exploitation
- Not known to be exploited in the wild according to the sources reviewed.
- No public proof-of-concept found.
- CISA SSVC assessment: Exploitation none, automatable yes, technical impact total.
- CISA KEV listing not verified.
Our recommendation
- Verify the installed version now on all appliance and container instances.
- Patch to the fixed release listed in IBM's bulletin, confirming the exact version first.
- Prioritise any instance reachable from the internet and restrict management access to trusted networks until patched.
- Monitor for unusual requests, deserialization errors and unexpected outbound connections from the server.
- Recheck CISA KEV and IBM's bulletin, as the status may have changed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin (CVE reference) www.ibm.com
- IBM Security Bulletin (Verify Identity Access 11) www.ibm.com
- The Hacker Wire: CVE-2026-78406 www.thehackerwire.com
- Strix AI: CVE-2026-78406 www.strix.ai
- SecurityOnline: IBM Verify Access vulnerabilities securityonline.info
- Cybersecurity News: IBM patches Verify Access flaw cybersecuritynews.com
- CyberUpdates365: IBM Verify Access vulnerabilities cyberupdates365.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:23.
Original description (NVD)
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.