CVE-2026-8861 is a vulnerability in IBM Verify Identity Access version 11.0 where detailed error messages returned in the browser expose sensitive information. This information disclosure vulnerability (CWE-209) can be exploited remotely without authentication, potentially assisting attackers in crafting further attacks against the system. The CVSS v3.1 base score is 5.3 (medium), with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss.

An attacker can remotely obtain sensitive information from detailed error messages returned by the IBM Verify Identity Access application. This information disclosure does not directly impact integrity or availability but may facilitate subsequent attacks by revealing internal system details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor IBM's advisories for updates and consider restricting error message verbosity in the application configuration if possible.