CVE-2026-16823

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

No known exploitation. EPSS puts it in the 25th percentile. A vendor fix is available.

CVSS 3.19.1Critical EPSS percentile25th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-10-08Updated 2026-10-10Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

IBM Security Verify AccessAffected: ≥ 10.0, ≤ 10.0.9.2Upgrade to: after 10.0.9.2Stated by: CVE record
IBM Verify Identity AccessAffected: ≥ 11.0, ≤ 11.0.3Upgrade to: after 11.0.3Stated by: CVE record
IBM Security Verify Access ContainerAffected: ≥ 10.0, ≤ 10.0.9.2Upgrade to: after 10.0.9.2Stated by: CVE record
IBM Verify Identity Access ContainerAffected: ≥ 11.0, ≤ 11.0.3Upgrade to: after 11.0.3Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which product and version you run: IBM Security Verify Access or IBM Verify Identity Access, including the appliance/container editions.
If you run IBM Security Verify Access 10.0 through 10.0.9.2, upgrade to 10.0.9.3.
If you run IBM Verify Identity Access 11.0 through 11.0.3, upgrade to 11.0.3.1.
Download the fix from IBM's support page and apply it to any container deployments as well as the appliance.
Confirm with your IT provider that the update was applied and the system now reports the fixed version.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication.

In plain language

Written by AI from the record

A critical flaw lets an attacker log into IBM's access-control software without a valid password, so if you run IBM Verify Identity Access or IBM Security Verify Access, you should update to the fixed version now.

CVE-2026-16823 is a remote, unauthenticated security-restriction bypass (CWE-287, improper authentication) in IBM Security Verify Access 10.0–10.0.9.2 and IBM Verify Identity Access 11.0–11.0.3, scoring 9.1 (critical) with no user interaction required.

If you're affected

Unauthorized access to protected systems
Bypass of login/access controls
Exposure of data behind this gateway
Compromise of identity infrastructure

What is it

This software acts like the security guard checking IDs before letting people into your building. This flaw lets someone slip past that guard without showing proper ID, potentially getting into systems they shouldn't. Because this product is often the gatekeeper for other business systems, a bypass here can open doors well beyond itself.

Who is affected

This matters to you if your organization uses IBM Security Verify Access or IBM Verify Identity Access (including the container editions) to control employee or customer access to applications. It affects the product whether deployed as a traditional appliance or as a container, and because no password or special access is needed to exploit it, anyone who can reach the system over the network is a potential attacker.

How urgent is it

There is no confirmed sign of this being exploited in the wild yet and no public exploit code exists, but this is a critical, unauthenticated bypass of the very software meant to enforce logins and access control — that combination makes it a high-value target the moment attackers study it. Treat this as urgent and apply the fix before exploitation begins, not after.

What to do — in detail

Inventory all deployments of IBM Security Verify Access and IBM Verify Identity Access, including appliance and container-based installs, and record exact version numbers.
For IBM Security Verify Access, confirm you are on a version in the 10.0–10.0.9.2 range before treating as vulnerable; target fixed version 10.0.9.3.
For IBM Verify Identity Access, confirm you are on 11.0–11.0.3 before treating as vulnerable; target fixed version 11.0.3.1.
Obtain the fix packages via IBM's official support page (https://www.ibm.com/support/pages/node/7291628) and review IBM's release notes for any upgrade prerequisites or breaking changes before applying.
Patch container images separately — rebuild/redeploy from the fixed base images rather than patching in place.
There is no documented workaround; if immediate patching isn't possible, restrict network reachability to the management/authentication interfaces as an interim mitigation.
No CISA KEV due date applies since this is not currently listed in KEV. Monitor IBM's advisory page and vendor security bulletins for any update on exploitation status, and watch authentication logs for anomalous bypass attempts after patching.

Technical context

CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects a remotely exploitable, low-complexity authentication bypass (CWE-287, improper authentication) with no privileges or user interaction needed, impacting confidentiality and integrity but not availability. It is not listed in CISA's Known Exploited Vulnerabilities catalog, no public exploit code is known, and EPSS places predicted exploitation likelihood in the lower range with a flat trend — indicating exploitation is currently theoretical rather than observed, though the critical severity and lack of required credentials warrant proactive patching ahead of any shift in exploit maturity.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS25th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 25th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising, driven by in-the-wild reports.

Lifecycle

12 events over 14 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-10-10Patch availablerecord updated
2026-10-09Patch availablepatch available, record updated, record updated
2026-10-08Patch availablepublished, weakness classified, att&ck mapped, record updated

Affected products

IBMcommercial · USaka international business machines
- Security Verify AccessSecurity ProductOn-premSecurity Products / identity-access-mgmt
- Verify Identity AccessSecurity ProductOn-premSecurity Products / identity-access-mgmt
- Security Verify Access ContainerSecurity ProductOn-premSecurity Products / identity-access-mgmt
- Verify Identity Access ContainerWeb AppOn-premSecurity Products / identity-access-mgmt

And 4 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Scored 9.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact