CVE-2026-8861 describes an information disclosure vulnerability in IBM Verify Identity Access 11.0. The issue arises because detailed technical error messages containing sensitive information are returned to the user's browser. This exposure could provide attackers with information useful for subsequent attacks. The vulnerability is identified as CWE-209. No official patch or remediation level has been provided by the vendor at this time, and there are no known exploits in the wild.

The vulnerability allows remote attackers to obtain sensitive information through error messages displayed in the browser. While it does not directly impact integrity or availability, the confidentiality impact is low to moderate as the disclosed information could facilitate further attacks against the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider configuring the system to suppress detailed error messages in user-facing responses to avoid information leakage.