CVE-2026-8860: IBM Verify Directory is affected by multiple vulnerabilities

Q: Which deployments are affected?

Affected versions are IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0. The issue also affects the IBM Security Verify Directory Web Application.

Q: What access does an attacker need to exploit this issue?

The supplied vector indicates network-reachable exploitation with low attack complexity, but it requires low privileges and no user interaction. The provided data does not specify which low-privilege account or access path is required.

Q: How could credentials be exposed?

Authentication requests can be sent using GET, placing credentials in URL parameters. Those URLs may then expose passwords through browser history and server logs.

Published Oct 23, 2026

Updated

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.

Other sources

IBM Security Verify Directory Web Application accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.

— IBM

Affected Software

2 affected components

IBM Security Verify Directory<=10.0.0-10.0.4

IBM Verify Directory<=11.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Verify Directory to a version that resolves this vulnerability.
Fixed in 11.0.1.2
Upgrade
Upgrade IBM Security Verify Directory to a version that resolves this vulnerability.
Fixed in 10.0.4.4

Event History

Oct 23, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·06:46 PM

Data Sourced

via MITRE·06:46 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7293828

Frequently Asked Questions

Which deployments are affected?

Affected versions are IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0. The issue also affects the IBM Security Verify Directory Web Application.

What access does an attacker need to exploit this issue?

The supplied vector indicates network-reachable exploitation with low attack complexity, but it requires low privileges and no user interaction. The provided data does not specify which low-privilege account or access path is required.

How could credentials be exposed?

Authentication requests can be sent using GET, placing credentials in URL parameters. Those URLs may then expose passwords through browser history and server logs.

CVE-2026-8860: IBM Verify Directory is affected by multiple vulnerabilities

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

How could credentials be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

How could credentials be exposed?