CVE-2026-8639 PUBLISHED

IBM Verify Directory is affected by multiple vulnerabilities

Assigner: ibm
Reserved: 14.05.2026 Published: 08.11.2026 Updated: 09.11.2026

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	IBM
Product	Security Verify Directory
Versions	affected from 10.0.0 to 10.0.4 (incl.)

Vendor	IBM
Product	Verify Directory
Versions	Version 11.0.0 is affected

Solutions

IBM strongly encourages customers to update their systems promptly.

Product(s)Affected Version(s)FixIBM Security Verify Directory10.0.0-10.0.4Download and install IBM Security Verify Directory v10.0.4.4 Download document - https://www.ibm.com/support/pages/node/7292855 IBM Verify Directory11.0.0Download and install IBM Verify Directory v11.0.1.2 Download document - https://www.ibm.com/support/pages/node/7290214

References

https://www.ibm.com/support/pages/node/7293828

Problem Types

CWE-384 Session Fixation CWE