Critical IBM Verify Access Flaws Enable Unauthenticated RCE and Authentication Bypass

IBM disclosed 22 vulnerabilities affecting IBM Verify Identity Access and IBM Security Verify Access that could allow complete system compromise. A bulletin covering seven of the flaws includes CVE-2026-78401 and CVE-2026-78406, untrusted deserialization vulnerabilities rated CVSS 9.8 that enable unauthenticated remote code execution. Other disclosed weaknesses include authentication bypass, protection mechanism failure, argument injection, arbitrary file writes, command execution, denial of service, and attacks against the administrative interface. Container deployments are also affected.

Organizations should prioritize upgrading IBM Security Verify Access to 10.0.9.3 and IBM Verify Identity Access to 11.0.3.1, or installing the corresponding updated container releases. The seven-flaw bulletin identifies affected versions as Security Verify Access 10.0–10.0.9.2 and Verify Identity Access 11.0–11.0.3. IBM reports no indications of exploitation and provides no workarounds; the accompanying report also identified no public exploits or CISA Known Exploited Vulnerabilities listings at publication. Prompt installation of the appropriate updates is the stated remediation.