CVE-2026-12004: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request.
Other sources
IBM Verify Identity Access contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Security Verify Accessto a version that resolves this vulnerability.Fixed in 10.0.9.2 - Upgrade
Upgrade
IBM Verify Identity Accessto a version that resolves this vulnerability.Fixed in 11.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12004?
The severity of CVE-2026-12004 is rated as high with a score of 8.7.
How do I fix CVE-2026-12004?
To fix CVE-2026-12004, update to the latest version of IBM Security Verify Access or IBM Verify Identity Access that addresses this vulnerability.
What systems are affected by CVE-2026-12004?
CVE-2026-12004 affects IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3.
What type of vulnerability is CVE-2026-12004?
CVE-2026-12004 is a format string injection vulnerability that can lead to denial of service and information disclosure.
What is the potential impact of CVE-2026-12004?
The potential impact of CVE-2026-12004 includes service disruptions and unauthorized access to sensitive information.