This vulnerability (CVE-2026-1345) affects IBM Verify Identity Access Container and IBM Security Verify Access Container in specified versions. It arises from improper neutralization of special elements in user input, leading to OS command injection. An unauthenticated attacker can exploit this flaw to execute arbitrary commands on the affected system with lower user privileges. The CVSS 3.1 base score is 7.3, indicating high severity, with attack vector network, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An unauthenticated attacker can execute arbitrary OS commands with the privileges of a lower-privileged user on the affected system. This can lead to partial compromise of system confidentiality, integrity, and availability. The impact is limited to the permissions of the lower-privileged user context under which commands are executed.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, restrict access to affected systems and monitor for suspicious activity related to command execution. Do not assume the vulnerability is mitigated without vendor confirmation.