CVE-2026-8640: IBM Verify Directory is affected by multiple vulnerabilities

Q: Which deployments are affected?

IBM Security Verify Directory versions 10.0.0 through 10.0.4 and version 11.0.0 are identified as affected. The IBM Security Verify Directory Web Application is also identified as not setting the SameSite attribute on session cookies.

Q: What must an attacker do to exploit this issue?

An attacker must cause an authenticated user's browser to send unauthorized requests to the application. The vulnerability is classified as requiring low attack complexity, low privileges, and user interaction.

Q: What is the expected impact of a successful attack?

The stated impact is integrity modification only; confidentiality and availability impacts are not identified.

Published Oct 23, 2026

Updated

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the application.

Other sources

IBM Security Verify Directory Web Application does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the application.

— IBM

Affected Software

2 affected components

IBM Security Verify Directory<=10.0.0-10.0.4

IBM Verify Directory<=11.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Verify Directory to a version that resolves this vulnerability.
Fixed in 11.0.1.2
Upgrade
Upgrade IBM Security Verify Directory to a version that resolves this vulnerability.
Fixed in 10.0.4.4

Event History

Oct 23, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·06:45 PM

Data Sourced

via MITRE·06:45 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7293828

Frequently Asked Questions

Which deployments are affected?

IBM Security Verify Directory versions 10.0.0 through 10.0.4 and version 11.0.0 are identified as affected. The IBM Security Verify Directory Web Application is also identified as not setting the SameSite attribute on session cookies.

What must an attacker do to exploit this issue?

An attacker must cause an authenticated user's browser to send unauthorized requests to the application. The vulnerability is classified as requiring low attack complexity, low privileges, and user interaction.

What is the expected impact of a successful attack?

The stated impact is integrity modification only; confidentiality and availability impacts are not identified.

CVE-2026-8640: IBM Verify Directory is affected by multiple vulnerabilities

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this issue?

What is the expected impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this issue?

What is the expected impact of a successful attack?