This vulnerability (CVE-2026-1342) in IBM Verify Identity Access Container and IBM Security Verify Access Container allows a locally authenticated user to execute malicious scripts originating from outside the trusted control sphere of the application. The issue affects versions 11.0 through 11.0.2 of Verify Identity Access Container and versions 10.0 through 10.0.9.1 of Security Verify Access Container. The CVSS v3.1 base score is 8.5, reflecting high severity with local attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. The vulnerability is related to CWE-829, which involves inclusion of functionality from an untrusted control sphere. No patch or official remediation level has been published as of the data provided.

A locally authenticated user could leverage this vulnerability to execute malicious scripts that originate outside the trusted control sphere, potentially leading to high confidentiality impact, limited integrity impact, and limited availability impact. This could allow unauthorized actions or data exposure within the affected IBM Verify Identity Access Container environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor IBM advisories closely for updates. Until a patch is available, restrict local access to trusted users only and consider additional monitoring or compensating controls to limit the risk of exploitation.