CVE-2026-8642: IBM Verify Directory is affected by multiple vulnerabilities

Q: Which deployments are affected?

IBM Security Verify Directory versions 10.0.0 through 10.0.4 and IBM Verify Directory version 11.0.0 are identified as exposing the affected debug endpoints. The data also identifies IBM Security Verify Directory Web Application as affected, but does not provide a version range for it.

Q: What access does an attacker need to exploit this issue?

The supplied CVSS vector indicates network attack access, low attack complexity, and low privileges required. No user interaction is required.

Q: What information could be exposed through the debug endpoints?

The endpoints can disclose system information, including server versions and session identifiers. Exposed version information can help an attacker identify software versions with known vulnerabilities.

Published Oct 23, 2026

Updated

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions.

Other sources

IBM Security Verify Directory Web Application exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions.

— IBM

Affected Software

2 affected components

IBM Security Verify Directory<=10.0.0-10.0.4

IBM Verify Directory<=11.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Verify Directory to a version that resolves this vulnerability.
Fixed in 11.0.1.2
Upgrade
Upgrade IBM Security Verify Directory to a version that resolves this vulnerability.
Fixed in 10.0.4.4

Event History

Oct 23, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·06:45 PM

Data Sourced

via MITRE·06:45 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7293828

Frequently Asked Questions

Which deployments are affected?

IBM Security Verify Directory versions 10.0.0 through 10.0.4 and IBM Verify Directory version 11.0.0 are identified as exposing the affected debug endpoints. The data also identifies IBM Security Verify Directory Web Application as affected, but does not provide a version range for it.

What access does an attacker need to exploit this issue?

The supplied CVSS vector indicates network attack access, low attack complexity, and low privileges required. No user interaction is required.

What information could be exposed through the debug endpoints?

The endpoints can disclose system information, including server versions and session identifiers. Exposed version information can help an attacker identify software versions with known vulnerabilities.

CVE-2026-8642: IBM Verify Directory is affected by multiple vulnerabilities

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What information could be exposed through the debug endpoints?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What information could be exposed through the debug endpoints?