Loading vulnerability…
Argument injection in IBM Security Verify Access and Verify Identity Access
CVE-2026-18740 is an argument injection vulnerability affecting IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3, including their Container editions. A remote authenticated attacker could exploit the flaw to perform unauthorized actions. The vulnerable function, affected endpoint, and precise argument-processing mechanism are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized actions within the affected product. The specific actions, resulting privileges, and effects on data or service availability are not established. Arbitrary command execution is not specifically established for CVE-2026-18740; the individual vulnerability descriptions attribute that outcome to CVE-2026-19482.
If you can’t patch tonight, do this now.
IBM documents no workaround or interim mitigation. Independent compensating-control guidance recommends restricting management and authentication endpoints to trusted networks where possible, implementing network segmentation, and using web application firewall rules targeting command injection. These measures are not verified fixes for this vulnerability and do not replace patching.
Patch, then assume compromise.
Upgrade IBM Security Verify Access appliances to version 10.0.9.3 and IBM Verify Identity Access appliances to version 11.0.3.1. For affected Container editions, apply the corresponding updated product images using IBM's container download guidance. IBM provides appliance fixes through Fix Central and recommends prompt updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.