CVE-2026-109126: IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials

Published Oct 19, 2026

Updated

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.

Affected Software

2 affected components

IBM Verify Identity Access=11.0.3.1

IBM Security Verify Access Appliance=10.0.9.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Security Verify Access to a version that resolves this vulnerability.
Fixed in 10.0.9.4
Upgrade
Upgrade IBM Verify Identity Access to a version that resolves this vulnerability.
Fixed in 11.0.3.2

Event History

Oct 19, 2026

CVE Published

via MITRE·11:43 PM

Data Sourced

via MITRE·11:43 PM

RemedyDescriptionSeverityWeakness

Oct 20, 2026

Data Sourced

via NVD·12:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be physically proximate to the affected appliance. No privileges or user interaction are required according to the supplied CVSS vector.

Which deployments are known to be affected?

IBM Verify Identity Access version 11.0.3.1 and IBM Security Verify Access Appliance version 10.0.9.3 are identified as affected. The provided data does not state whether other versions or configurations are affected.

What is the potential impact if exploitation succeeds?

An attacker could gain elevated privileges through hard-coded credentials. The supplied CVSS vector indicates high impacts to confidentiality, integrity, and availability.