CVE-2026-11939: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs high privileges. Exploitation is network-accessible, requires no user interaction, and has low attack complexity.

Q: What is the practical impact?

The listed impact is limited to integrity: an attacker may forge audit logs. The provided CVSS vector indicates no confidentiality or availability impact.

Q: Which deployments are identified as affected?

Affected releases are IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3.

Published Oct 8, 2026

Updated

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery.

Affected Software

2 affected components

IBM Security Verify Access>=10.0<=10.0.9.2

IBM Verify Identity Access>=11.0<=11.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Security Verify Access to a version that resolves this vulnerability.
Fixed in 10.0.9.3
Upgrade
Upgrade IBM Verify Identity Access to a version that resolves this vulnerability.
Fixed in 11.0.3.1

Event History

Oct 8, 2026

CVE Published

via MITRE·09:06 PM

Data Sourced

via MITRE·09:06 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs high privileges. Exploitation is network-accessible, requires no user interaction, and has low attack complexity.

What is the practical impact?