CVE-2026-19491

Think of this like a security guard at your office door who's supposed to check ID badges before letting anyone in — this flaw lets someone walk right past the guard without showing any ID and get full access to the building, including the manager's office. Since this software manages who can log into your other systems, someone bypassing it could effectively unlock everything it protects.

This matters to you if you run IBM Security Verify Access or IBM Verify Identity Access (including the container-based versions of either) to manage employee or customer logins and access control. The flaw is reachable over the network by default, meaning no special setup or misconfiguration is needed for an attacker to try it.

This is a severe, easily exploitable flaw — it requires no login credentials and no action from any user, and the affected system is reachable by default, making it an attractive target. There is no confirmed evidence yet of attackers actively exploiting it in the wild, but given the ease of exploitation and the critical access it grants, you should treat this as urgent and patch without delay rather than wait for an incident.

Identify all deployments of IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3), including appliance and container-based installs. Upgrade Security Verify Access to 10.0.9.3 or later, and Verify Identity Access to 11.0.3.1 or later, following IBM's published fix instructions at https://www.ibm.com/support/pages/node/7291628. There is no indication of breaking changes beyond standard version upgrade procedures, but test in a staging environment first if your deployment is customized. If immediate patching isn't possible, restrict network-level access to the authentication/admin endpoints (e.g., via firewall rules or VPN-only access) as a temporary mitigation. No CISA KEV listing or mandated remediation date currently applies, and no public exploit code or confirmed in-the-wild exploitation has been reported, but monitor IBM's advisory page and your logs for authentication anomalies following disclosure.

CVSS 9.1 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N — reflects a network-exploitable authentication bypass requiring no privileges or user interaction, with high confidentiality and integrity impact but no availability impact. Weakness type is CWE-287 (Improper Authentication). The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog, no public exploit code has been identified, and press coverage shows no confirmed in-the-wild exploitation as of this writing — exploit maturity is theoretical/PoC-less at this time. Predicted exploitation likelihood is currently low per automated scoring models, but this should be weighed against the vulnerability's severity and the fact that remote, unauthenticated attack paths tend to see rapid real-world weaponization once technical details circulate.