CVE-2026-8639: IBM Verify Directory is affected by multiple vulnerabilities

Q: Which deployments are identified as affected?

IBM Security Verify Directory versions 10.0.0 through 10.0.4 and IBM Verify Directory version 11.0.0 are identified as affected. The IBM Security Verify Directory Web Application is also described as vulnerable.

Q: What does an attacker need to exploit this issue?

The attacker must first establish a session, then have a victim authenticate using that session. After authentication, the attacker can hijack the authenticated session.

Q: What access could an attacker obtain?

Successful session hijacking can give the attacker unauthorized access to the directory management console.

Published Oct 23, 2026

Updated

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console.

Other sources

IBM Security Verify Directory Web Application is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console.

— IBM

Affected Software

2 affected components

IBM Security Verify Directory<=10.0.0-10.0.4

IBM Verify Directory<=11.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Verify Directory to a version that resolves this vulnerability.
Fixed in 11.0.1.2
Upgrade
Upgrade IBM Security Verify Directory to a version that resolves this vulnerability.
Fixed in 10.0.4.4

Event History

Oct 23, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·06:44 PM

Data Sourced

via MITRE·06:44 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7293828

Frequently Asked Questions

Which deployments are identified as affected?

IBM Security Verify Directory versions 10.0.0 through 10.0.4 and IBM Verify Directory version 11.0.0 are identified as affected. The IBM Security Verify Directory Web Application is also described as vulnerable.

What does an attacker need to exploit this issue?

The attacker must first establish a session, then have a victim authenticate using that session. After authentication, the attacker can hijack the authenticated session.

What access could an attacker obtain?

Successful session hijacking can give the attacker unauthorized access to the directory management console.

CVE-2026-8639: IBM Verify Directory is affected by multiple vulnerabilities

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are identified as affected?

What does an attacker need to exploit this issue?

What access could an attacker obtain?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are identified as affected?

What does an attacker need to exploit this issue?

What access could an attacker obtain?