IBM has patched 22 security vulnerabilities in IBM Verify Identity Access and IBM Security Verify Access, including two critical flaws that could allow unauthenticated attackers to execute arbitrary code remotely.
The most severe vulnerabilities, tracked as CVE-2026-78401 and CVE-2026-78406, both carry a CVSS score of 9.8.
According to IBM’s official security bulletin, both flaws are caused by unsafe deserialization of untrusted data and can be exploited remotely without authentication or user interaction.
The October 7, 2026 update addresses vulnerabilities affecting both appliance and container deployments across IBM Security Verify Access 10.x and IBM Verify Identity Access 11.x.
For broader coverage of enterprise vulnerabilities and patching priorities, see our CVE and Vulnerability Exploits 2026 Hub.
Key Takeaway
IBM has fixed 22 vulnerabilities across Verify Identity Access and Security Verify Access. The most serious are two unauthenticated remote code execution flaws rated CVSS 9.8. IBM has released patched versions and lists no workarounds, making upgrading the primary remediation path.
Two Critical IBM Verify Access Flaws Allow Unauthenticated RCE
The two highest-severity vulnerabilities are CVE-2026-78401 and CVE-2026-78406.
Both vulnerabilities stem from the deserialization of untrusted data.
Deserialization vulnerabilities occur when software reconstructs data into objects without adequately validating whether the supplied data is safe.
If an attacker can control that data, the process can sometimes be abused to execute attacker-supplied code.
IBM describes both CVE-2026-78401 and CVE-2026-78406 as remotely exploitable without authentication.
- CVE-2026-78401 — unauthenticated remote code execution through unsafe deserialization, CVSS 9.8
- CVE-2026-78406 — unauthenticated remote code execution through unsafe deserialization, CVSS 9.8
IBM’s CVSS vectors indicate that exploitation requires network access, low attack complexity, no privileges and no user interaction.
Three More Vulnerabilities Carry CVSS Scores of 9.1
IBM also fixed three vulnerabilities rated 9.1.
CVE-2026-16916
CVE-2026-16916 affects the IBM Security Verify Access Appliance and could allow a remote authenticated attacker with high privileges to execute arbitrary code due to a protection mechanism failure.
CVE-2026-16823
CVE-2026-16823 is an improper authentication vulnerability that could allow a remote attacker to bypass security restrictions.
IBM rates the flaw at CVSS 9.1 and does not require authentication according to the published vector.
CVE-2026-19491
CVE-2026-19491 could allow a remote attacker to bypass authentication because of improper authentication controls.
It also carries a CVSS score of 9.1.
Command Injection Flaws Could Enable Arbitrary Commands
Two additional high-severity vulnerabilities involve argument and command injection.
CVE-2026-18740, rated CVSS 8.8, could allow a remote authenticated attacker to perform unauthorized actions through argument injection.
CVE-2026-19482, also rated CVSS 8.8, could allow an authenticated attacker to execute arbitrary commands because command arguments are not sufficiently neutralized.
Both issues require valid access, but successful exploitation could significantly increase an attacker’s control over an affected system.
Path Traversal Could Allow Arbitrary File Writes
IBM also patched CVE-2026-19493, a path traversal vulnerability rated CVSS 7.5.
The flaw could allow a remote attacker to perform an arbitrary file write on an affected IBM Security Verify Access appliance.
Arbitrary file-write vulnerabilities can be dangerous because an attacker may be able to place files in locations that were never intended to be writable from a remote request.
IBM’s bulletin does not state that CVE-2026-19493 can independently be used to achieve remote code execution.
Other Flaws Include XSS, SQL Injection and Authentication Bypass
The October security update addresses a broad mix of vulnerability classes.
Among the remaining issues are:
- CVE-2026-17189 — reflected cross-site scripting with potential code execution impact in a local context, CVSS 8.2
- CVE-2026-19494 — authenticated security-restriction bypass, CVSS 8.1
- CVE-2026-78399 — authenticated denial of service through uncontrolled resource allocation, CVSS 6.5
- CVE-2026-19878 — bypass of additional authentication workflow steps, CVSS 6.5
- CVE-2026-11888 — information disclosure affecting Snapshot Manager Container, CVSS 6.4
- CVE-2026-19498 — remote denial of service through uncontrolled recursion, CVSS 5.9
- CVE-2026-11930 — incorrect authorization enforcement for some web servers, CVSS 5.9
- CVE-2026-16830 — authenticated SQL injection that could modify data or cause denial of service, CVSS 5.4
- CVE-2026-78407 — authenticated cross-site scripting, CVSS 5.4
- CVE-2026-11936 — cross-site scripting in the local management interface, CVSS 4.9
- CVE-2026-78388 — cross-site request forgery, CVSS 4.3
- CVE-2026-12091 — denial of service through an out-of-bounds read, CVSS 3.7
- CVE-2026-11939 — audit log forgery, CVSS 2.7
IBM also fixed CVE-2026-12109, which involves an out-of-bounds write and could allow code execution when an attacker already has administrative privileges and access to the local management interface.
Which IBM Verify Access Versions Are Affected?
IBM lists the following products and versions as affected:
- IBM Security Verify Access — versions 10.0 through 10.0.9.2
- IBM Verify Identity Access — versions 11.0 through 11.0.3
- IBM Security Verify Access Container — versions 10.0 through 10.0.9.2
- IBM Verify Identity Access Container — versions 11.0 through 11.0.3
IBM Releases Fixed Versions
IBM is urging customers to update affected systems promptly.
For appliance deployments, the fixed versions are:
- IBM Verify Identity Access 11.x — update to version 11.0.3.1
- IBM Security Verify Access 10.x — update to version 10.0.9.3
Container customers should update using IBM’s current container images and download guidance.
IBM does not list any workaround or mitigation for these vulnerabilities.
No Workaround Means Patching Is the Main Remediation
The absence of a workaround is important for organizations running vulnerable deployments.
IBM’s bulletin lists the fixed versions as the remediation and encourages customers to update promptly.
Organizations should identify exposed Verify Access appliances and containers, confirm their current versions and prioritize systems running affected releases.
Security teams should also review administrative and authentication logs for unusual behavior before and after upgrading.
Are These IBM Verify Access Vulnerabilities Being Exploited?
IBM’s October bulletin does not report active exploitation of the newly disclosed vulnerabilities.
There is also no exploitation status in the bulletin indicating that CVE-2026-78401 or CVE-2026-78406 has been confirmed in real-world attacks.
That distinction is important because a CVSS score of 9.8 reflects potential severity and exploitability characteristics, not proof that attackers are already exploiting the flaw.
Organizations should still patch quickly because both critical vulnerabilities can be reached remotely without authentication according to IBM’s assessment.
Why Identity and Access Infrastructure Is a High-Value Target
Identity and access management systems sit close to authentication, session management and authorization workflows.
A compromise of this layer can have a broader impact than a weakness in an isolated business application because identity infrastructure can influence access to multiple downstream systems.
The October bulletin is particularly important because it includes flaws affecting authentication controls, authorization enforcement, command execution and remote code execution in the same product family.
What Administrators Should Do Now
Organizations running IBM Verify Identity Access or IBM Security Verify Access should:
- Identify every appliance and container deployment
- Confirm whether the installed version is affected
- Upgrade appliances to IBM Verify Identity Access 11.0.3.1 or IBM Security Verify Access 10.0.9.3
- Update container deployments using IBM’s latest supported images
- Review authentication and administrative logs for suspicious activity
- Investigate unusual authorization bypasses or unexplained configuration changes
- Restrict management interfaces to trusted administrative networks
- Maintain tested backups of critical configuration data
Because IBM lists no workaround, delaying the vendor update leaves affected systems dependent on surrounding security controls rather than a direct fix for the vulnerabilities.
Frequently Asked Questions
How many IBM Verify Access vulnerabilities were patched?
IBM’s October 7, 2026 security bulletin lists 22 vulnerabilities affecting IBM Verify Identity Access, IBM Security Verify Access and their container deployments.
What are the most severe IBM Verify Access vulnerabilities?
CVE-2026-78401 and CVE-2026-78406 are the most severe. Both are unauthenticated remote code execution vulnerabilities caused by unsafe deserialization and carry CVSS scores of 9.8.
Can CVE-2026-78401 be exploited without authentication?
Yes. IBM describes CVE-2026-78401 as remotely exploitable without authentication due to deserialization of untrusted data.
Which IBM Verify Access versions are fixed?
IBM directs appliance customers to install IBM Verify Identity Access 11.0.3.1 or IBM Security Verify Access 10.0.9.3. Container users should update to the current fixed container release provided by IBM.
Is there a workaround?
No. IBM’s bulletin lists no workaround or mitigation and recommends updating affected systems promptly.
Are these vulnerabilities actively exploited?
IBM’s bulletin does not report confirmed active exploitation of the October 2026 vulnerabilities. Organizations should still prioritize patching because the critical flaws are remotely reachable without authentication.
Final Takeaway
IBM’s October security update is significant because it addresses 22 vulnerabilities across products responsible for enterprise identity and access control.
The two most serious flaws, CVE-2026-78401 and CVE-2026-78406, can allow unauthenticated remote code execution and carry CVSS scores of 9.8.
The same release also fixes authentication bypass, argument injection, path traversal, SQL injection, cross-site scripting and denial-of-service vulnerabilities.
IBM has not published a workaround and instead directs customers to upgrade to the fixed appliance or container versions.
Organizations running affected releases should treat the update as a priority, particularly where Verify Access systems are exposed to untrusted networks or protect sensitive authentication workflows.
