Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

IBM Verify and Security Verify Access: Weak Cryptography

CVE-2026-17616 · published 22 days ago
Summary

IBM Verify Identity Access and IBM Security Verify Access may not properly verify user input, potentially allowing attackers to bypass security checks. This affects users who rely on these systems for secure authentication. To mitigate this risk, update to the latest versions of the affected software.

What to do
  • Update ibm security_verify_access to version 10.0.9.2 or later.
  • Update ibm verify_identity_access to version 11.0.3 or later.
Affected software
VendorProductAffected versions
ibm security verify access <= 10.0.9.2
ibm verify identity access <= 11.0.3
ibm verify identity access container <= 11.0.3
ibm security verify access container <= 10.0.9.2
ibm security_verify_access >= 10.0.0, < 10.0.9.2
10.0.9.2
cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*
ibm security_verify_access_container >= 10.0.0.0, <= 10.0.9.2
cpe:2.3:a:ibm:security_verify_access_container:*:*:*:*:*:*:*:*
ibm verify_identity_access >= 11.0, < 11.0.3
11.0.3
cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:*
ibm verify_identity_access_container >= 11.0.0.0, <= 11.0.3
cpe:2.3:a:ibm:verify_identity_access_container:*:*:*:*:*:*:*:*
Original advisory text
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurati...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.
References
Severity
9.8 Critical
CVSS 3.1: 6.8 (MITRE)
Exploitation
EPSS <1%
Type
CWE-310Cryptographic Issues
Timeline
Published12 Aug 2026
Updated29 Aug 2026
First seen12 Aug 2026
Sources
CVE-2026-17616 · NVD
CVE-2026-17616 · MITRE
Monitor software like this
Free during beta