CVE-2026-11936: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

Q: What level of access does an attacker need to exploit this issue?

The attacker must be authenticated and have low-level privileges. Exploitation is network-accessible, requires no user interaction, and has high attack complexity.

Q: Are all deployments in the listed version ranges affected?

No. The issue affects the local management interface only in certain configurations. The available information does not identify which configurations are vulnerable.

Published Oct 8, 2026

Updated

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

2 affected components

IBM Security Verify Access>=10.0<=10.0.9.2

IBM Verify Identity Access>=11.0<=11.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Security Verify Access to a version that resolves this vulnerability.
Fixed in 10.0.9.3
Upgrade
Upgrade IBM Verify Identity Access to a version that resolves this vulnerability.
Fixed in 11.0.3.1

Event History

Oct 8, 2026

CVE Published

via MITRE·09:02 PM

Data Sourced

via MITRE·09:02 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must be authenticated and have low-level privileges. Exploitation is network-accessible, requires no user interaction, and has high attack complexity.

Are all deployments in the listed version ranges affected?