CVE-2026-78406

This software acts like the front door that checks who is allowed into your company's systems. The flaw means a stranger can walk straight through that door without a key and start giving the building's computers their own instructions, with no need to log in first.

This matters to you if you run IBM Security Verify Access (versions 10.0 through 10.0.9.2) or IBM Verify Identity Access (versions 11.0 through 11.0.3), including the container editions. Because no login or user action is needed, any instance of this software reachable over the network is at risk.

This is a critical, unauthenticated remote code execution flaw — an attacker needs nothing more than network access to the system to take it over completely, which is about as severe as a vulnerability gets. There is no confirmed active exploitation or public exploit code yet, but given the ease of attack and the severity of full system compromise, this should be treated as an emergency patch, not a routine one.

Confirm exposure by identifying all deployed instances of IBM Security Verify Access (10.0–10.0.9.2) and IBM Verify Identity Access (11.0–11.0.3), including containerized deployments, and check whether they are reachable from untrusted networks or the internet. Upgrade IBM Security Verify Access to 10.0.9.3 and IBM Verify Identity Access to 11.0.3.1 per IBM's advisory (https://www.ibm.com/support/pages/node/7291628). There is no documented workaround beyond network isolation; if patching cannot be done immediately, restrict inbound access to the affected service/listener to trusted management networks only. No CISA KEV listing or due date exists for this CVE at this time, and no public exploit code has been observed, but given the deserialization-based unauthenticated RCE and CVSS 9.8 rating, prioritize this above routine patch cycles. Monitor IBM's security bulletin for updates and watch for any future KEV listing or exploit disclosure.

CVSS 3.1 score 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, low complexity, no privileges or user interaction required, full compromise of confidentiality/integrity/availability. Weakness is CWE-502 (Deserialization of Untrusted Data). Not currently listed in CISA KEV; no dated press reporting of exploitation; no public exploit code on record. EPSS places predicted near-term exploitation likelihood in the lower-middle percentile with a flat trend, consistent with no confirmed in-the-wild activity, though press attention is rising via a general vulnerability roundup rather than exploitation reporting.