CVE-2026-19493: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM Security Verify Access

IBM Security Verify Access versions 10.0 to 10.0.9.2 and IBM Verify Identity Access versions 11.0 to 11.0.3 contain a CWE-22 path traversal vulnerability. This vulnerability permits a remote attacker to write arbitrary files on the system by bypassing pathname restrictions, potentially leading to unauthorized modification of files. The CVSS 3.1 base score is 7.5, indicating high severity, with attack vector network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

A successful exploitation of this vulnerability allows an unauthenticated remote attacker to write arbitrary files on the affected system, potentially leading to unauthorized code execution or system compromise. The integrity of the system can be severely impacted, but confidentiality and availability are not directly affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisory details are provided, users should monitor IBM's official security advisories for updates and apply any official fixes once available. Until then, consider restricting network access to the affected services and applying compensating controls as appropriate.