CVE-2026-11937 is a use-after-free vulnerability in IBM Security Verify Access and IBM Verify Identity Access products, including their containerized versions. This flaw affects versions 10.0 through 10.0.9.2 for Security Verify Access and 11.0 through 11.0.3 for Verify Identity Access. The vulnerability can be triggered in certain configurations of the Reverse Proxy component, causing a denial of service (DoS) condition. The CVSS v3.1 base score is 3.1, reflecting low severity with network attack vector, high attack complexity, low privileges required, no user interaction, and impact limited to availability. There is no known exploit in the wild and no vendor advisory or patch information available at this time.

The vulnerability allows an attacker with network access and low privileges to cause a denial of service by exploiting a use-after-free condition in the Reverse Proxy component of affected IBM Security Verify Access and Verify Identity Access versions. There is no impact on confidentiality or integrity, only availability is affected. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review their configurations to minimize exposure to the vulnerable Reverse Proxy component and consider applying any recommended workarounds from IBM once available.