Threats affecting pkg:rpm/ibm/verify_identity_access

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.

CVE-2026-11930 is an authorization vulnerability in IBM Security Verify Access and IBM Verify Identity Access. Versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3 may not correctly enforce authorization for some web servers, potentially allowing unauthorized actions. The vulnerability has a medium severity rating and a CVSS score of 5.9.

CVE-2026-11939 is a low-severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access that may allow audit log forgery due to improper neutralization of argument delimiters (CWE-88). It affects versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. The vulnerability does not impact confidentiality or availability but can affect the integrity of audit logs.

CVE-2026-16916 is a critical vulnerability in IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3. It involves a protection mechanism failure that could allow a remote authenticated attacker to execute arbitrary code. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. No patch or vendor advisory information is provided regarding remediation status.

CVE-2026-19498 is a medium severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. It involves uncontrolled recursion that could be triggered remotely, leading to a denial of service condition. No confidentiality or integrity impacts are indicated. The vulnerability requires high attack complexity and no privileges or user interaction. No known exploits are reported, and no patch information is provided.

CVE-2026-19493 is a path traversal vulnerability in IBM Security Verify Access and IBM Verify Identity Access versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. This flaw allows a remote attacker to perform arbitrary file write operations on the affected systems. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating significant risk if exploited. No information about available patches or vendor advisories is provided.

CVE-2026-12091 is a low severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access. It involves a heap-based out-of-bounds read that could be triggered remotely by sending a specially crafted request. This flaw may cause a denial of service but does not impact confidentiality or integrity. The affected versions are IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3.

CVE-2026-12109 is an out-of-bounds write vulnerability in IBM Security Verify Access and IBM Verify Identity Access. It affects versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. An attacker with administrative privileges and local management interface access could exploit this to execute arbitrary code. The vulnerability arises from an unbounded write to a fixed-size stack buffer.

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.