IBM Verify Identity Access contains a CWE-400 Uncontrolled Resource Consumption vulnerability identified as CVE-2026-11926. The flaw arises from insufficient validation of incoming request resources, which a remote attacker can exploit to cause a denial of service condition. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. No known exploits are reported in the wild. The affected versions are exactly 10.0.0 and 11.0.0.

Successful exploitation results in denial of service by exhausting resources on the affected system, disrupting availability of IBM Verify Identity Access services. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's advisories for updates. Until a fix is available, consider limiting exposure of the affected service to untrusted networks and applying any recommended configuration changes from IBM to mitigate resource exhaustion risks.