CVE-2026-109126 PUBLISHED

IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials

Assigner: ibm
Reserved: 12.10.2026 Published: 19.10.2026 Updated: 20.10.2026

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Adjacent Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	IBM
Product	Verify Identity Access
Versions	Version 11.0.3.1 is affected

Vendor	IBM
Product	Security Verify Access
Versions	Version 10.0.9.3 is affected

Solutions

IBM encourages customers to update their systems promptly.

Appliance:

Affected Products

Fix availability

IBM Verify Identity Access

Download IBM Verify Identity Access v11.0.3.2 https://www.ibm.com/support/fixcentral/swg/selectFix

IBM Security Verify Access

Download IBM Security Verify Access v10.0.9.4 https://www.ibm.com/support/fixcentral/swg/selectFixes

References

https://www.ibm.com/support/pages/node/7292606

Problem Types

CWE-798 Use of Hard-coded Credentials CWE