On 7 October, IBM published a single security bulletin covering 22 CVEs in IBM Verify Identity Access and IBM Security Verify Access. Five of them score 9.0 or higher. Four of those five can be reached by a remote attacker who has no account, and that is the part worth slowing down on.
IBM lists no workarounds. The fix is an upgrade.
What the Bulletin Covers
IBM's security bulletin applies to both the appliance and container builds of the two products. It was first published on 7 October and updated on 12 October. These are the five entries scored 9.0 or higher:
- CVE-2026-78401 (CVSS 9.8): remote code execution through deserialisation of untrusted data. No login needed.
- CVE-2026-78406 (9.8): same weakness class, separate flaw. No login needed.
- CVE-2026-19491 (9.1): authentication bypass (improper authentication, CWE-287). No login needed.
- CVE-2026-16823 (9.1): security restrictions bypassed through improper authentication. No login needed.
- CVE-2026-16916 (9.1): code execution through a protection mechanism failure. Needs a high-privilege account.
Below those sits a long tail. Two authenticated command and argument injection bugs score 8.8, a further authenticated bypass of security restrictions scores 8.1, and a path-traversal file write scores 7.5. The rest are cross-site scripting, CSRF, SQL injection, denial of service and audit-log forgery issues. One lower-rated entry lets an authenticated user skip steps in an authentication workflow, which is worth a read if you rely on step-up flows.
One detail to sort out before you plan the upgrade. The individual CVE entries describe versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. The affected-products table on the same page goes slightly further, to 10.0.9.3 and 11.0.3.1. The fixed appliance releases are Verify Identity Access 11.0.3.2 and Security Verify Access 10.0.9.4, so we would treat anything below those as exposed and not spend time debating the exact boundary.
Why a Bypass in the Gateway Is Worse Than a Bypass in an App
In many deployments, an access manager like this sits in front of the applications it protects. It terminates the session, evaluates policy and passes identity downstream, often as headers or tokens the application trusts without question. That arrangement is deliberate, and it works well until the gateway itself is wrong about who is at the door.
Take CVE-2026-19491. IBM's vector reads network-reachable, low complexity, no privileges, no user interaction, high impact on confidentiality and integrity, none on availability. In plain terms, an attacker with network access can get in, read and change things, and break nothing on the way. A profile like that tends to be quiet: nothing falls over, so nothing pages anyone.
The two 9.8 entries are a different kind of problem. Deserialisation of untrusted data is an old and well-understood class. A service accepts a serialised object over the network, rebuilds it without checking what is inside, and a crafted payload gets code to run during the rebuild. IBM's entries do not say which interface carries the vulnerable path, so the bulletin alone cannot tell you what is exposed in your deployment. That is a question for your own network diagrams, and it is worth asking before anyone says "it's internal only".
A couple of the entries also involve the local management interface (LMI). Whatever else you do this week, make sure that interface is reachable only from a management network.
What We'd Do This Week
1. Find every instance
Appliances, containers, disaster-recovery copies, and the pre-production clone someone built two years ago. Anything below Verify Identity Access 11.0.3.2 or Security Verify Access 10.0.9.4 is in scope.
2. Patch what faces untrusted networks first
The four critical flaws that need no account set the order: internet-facing instances, partner-facing instances, then anything reachable from a flat internal network. IBM lists no workaround, so there is no configuration change that buys time.
3. Take the management interface off shared networks
The LMI belongs on a management network with its own access controls. This is worth doing whether or not this bulletin exists.
4. Look back as well as forward
We have seen no public report of exploitation, and the bulletin does not claim any. That describes what is public, not what is in your logs. On the gateway, look for sessions with no matching authentication event, unexpected administrative actions, changed policies or ACLs, and files written to unusual paths.
5. Decide what you would rotate if you had to
If anything looks wrong, you will need to know which secrets the gateway holds, such as signing keys, client secrets and directory bind credentials, and how you would invalidate active sessions. Work that out before you need it.
The Trevonix Perspective
At Trevonix, we read bulletins like this as a test of something unglamorous: whether an organisation knows what it runs. Access management estates accumulate. A gateway deployed for one application picks up a dozen more, a second environment appears for a migration, and ownership drifts. When a 9.8 lands, the gap between "we should patch this" and "we know every place it runs" is where the risk sits.
The practical answer is a mix of inventory, patch discipline and a clear view of what each identity component can reach if it turns out to be wrong. That is the work behind Identity Operations & Managed Services and an Identity Maturity Assessment: knowing the estate well enough that the urgent fix is also a quick one.
The architectural point stands as well. An authentication gateway is a single point of trust, and a zero trust identity architecture assumes it can be wrong. Applications behind it should still validate what they are told, high-value actions should still ask for fresh evidence, and the gateway's own management plane should be among the most tightly controlled surfaces you have.
Key Takeaways
- IBM's 7 October bulletin covers 22 CVEs in Verify Identity Access and Security Verify Access. Five score 9.0 or higher, and four of those need no login.
- CVE-2026-19491 is an authentication bypass at CVSS 9.1. Two further unauthenticated flaws allow remote code execution at 9.8.
- IBM lists no workarounds. The fixed appliance releases are Verify Identity Access 11.0.3.2 and Security Verify Access 10.0.9.4.
- Patch internet-facing and partner-facing instances first, and restrict the management interface now.
- Review gateway logs for the period before you patched, not only after.
Source Credits: IBM Support (security bulletin for Verify Identity Access and Security Verify Access)
