CVE-2026-19491: CWE-287 Improper Authentication in IBM Security Verify Access

IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3 contain an improper authentication vulnerability (CWE-287) that allows remote attackers to bypass authentication mechanisms. This vulnerability enables attackers to gain unauthorized access without credentials or user interaction, impacting confidentiality and integrity. The CVSS 3.1 base score is 9.1 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. No patch or remediation details are provided in the data.

Successful exploitation of this vulnerability could allow remote attackers to bypass authentication controls, gaining unauthorized access to the affected systems. This can lead to full compromise of sensitive data confidentiality and integrity. There is no indication of availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor IBM's security advisories for updates. Until a fix is available, consider restricting network access to the affected services and applying compensating controls as appropriate.