CVE-2026-19494: CWE-287 Improper Authentication in IBM Security Verify Access

CVE-2026-19494 is an improper authentication vulnerability (CWE-287) affecting IBM Security Verify Access versions 10.0 to 10.0.9.2 and IBM Verify Identity Access versions 11.0 to 11.0.3. It allows a remote attacker with authentication privileges to bypass security restrictions, potentially leading to unauthorized access or actions. The vulnerability is rated high severity with a CVSS 3.1 score of 8.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity. No vendor advisory or patch information is currently available.

An attacker with valid authentication credentials can bypass security restrictions, potentially gaining unauthorized access to sensitive information or performing unauthorized actions. The vulnerability impacts confidentiality and integrity but does not affect availability. This could lead to significant security breaches if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to affected versions and monitor for suspicious activity involving authenticated users.