Loading vulnerability…
Authenticated denial of service in IBM Verify Access
CVE-2026-78399 is an improper resource allocation vulnerability affecting IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3. An authenticated user can submit a specially crafted HTTP query that triggers improper allocation of system resources and causes denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disrupt availability of the affected IBM Verify Access service. The duration and extent of the disruption are not specified.
If you can’t patch tonight, do this now.
No interim workaround is identified. Install the applicable IBM security update.
Patch, then assume compromise.
Update IBM Security Verify Access to version 10.0.9.3 or IBM Verify Identity Access to version 11.0.3.1, as applicable. For container deployments, install the corresponding updated container release supplied by IBM.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.