CVE-2026-16823: CWE-287 Improper Authentication in IBM Security Verify Access
Description
CVE-2026-16823 is a critical improper authentication vulnerability in IBM Security Verify Access and IBM Verify Identity Access. It affects versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. This flaw could allow a remote attacker to bypass security restrictions without authentication, potentially leading to full confidentiality and integrity compromise. The vulnerability has a CVSS score of 9.1, indicating high severity. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.
CVSS v3.1
Score 9.1critical
Affected software
IBM
Security Verify Access
IBM
Verify Identity Access
IBM
Security Verify Access Container
IBM
Verify Identity Access Container
pkg:maven/com.ibm/security_verify_accesspkg:maven/com.ibm/verify_identity_accesscpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
IBM Security Verify Access versions 10.0 to 10.0.9.2 and IBM Verify Identity Access versions 11.0 to 11.0.3 contain an improper authentication vulnerability (CWE-287). This vulnerability allows a remote attacker to bypass authentication controls, potentially gaining unauthorized access to protected resources. The CVSS v3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. The vulnerability was published on 2026-10-08. No vendor advisory or patch information is provided in the input data.
Potential Impact
Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to bypass security restrictions, leading to unauthorized access with full confidentiality and integrity impact. Availability is not affected. This could result in exposure or modification of sensitive information within the affected IBM Security Verify Access or Verify Identity Access environments.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor IBM's security advisories for updates and consider applying compensating controls to restrict access to affected systems.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ibm
- Date Reserved
- 2026-07-24T02:12:57.599Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac808d12cdf04f65634c8fc
Added to database: 10/08/2026, 21:19:13 UTC
Last enriched: 10/08/2026, 21:34:30 UTC
Last updated: 10/08/2026, 23:48:21 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.