CVE-2026-12004 is a format string injection vulnerability (CWE-134) affecting IBM Security Verify Access and related products in specified versions. The flaw exists in the management interface, where externally controlled input is improperly handled in format strings. Exploitation requires high privileges and no user interaction, enabling attackers to cause denial of service and disclose sensitive information via malicious HTTP requests. The vulnerability has a CVSS 3.1 base score of 8.7, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality and availability.

An attacker with high privileges can exploit this vulnerability remotely over the network without user interaction to cause denial of service and disclose sensitive information. The impact includes potential service disruption and exposure of confidential data within the affected IBM Security Verify Access management interface.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the management interface to trusted administrators only and monitor for suspicious activity.