CVE-2026-78406 – IBM Security Verify Access
“When the system that guards every login can be bypassed, every door behind it is already open.”
IBM's update fixes seven vulnerabilities in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3. The two most severe flaws let a remote attacker with no credentials run arbitrary code through deserialization of untrusted data: CVE-2026-78401 and CVE-2026-78406 each have a CVSS score of 9.8, Critical severity. Three improper authentication flaws let attackers bypass security restrictions or authentication: CVE-2026-16823 and CVE-2026-19491 each have a CVSS score of 9.1, Critical severity, and CVE-2026-19494 has a CVSS score of 8.1, High severity.
The update also fixes a protection mechanism failure that lets an authenticated attacker run arbitrary code. CVE-2026-16916 has a CVSS score of 9.1, Critical severity. It also fixes a path traversal flaw that allows arbitrary file writes. CVE-2026-19493 has a CVSS score of 7.5, High severity. This platform controls identity and access for the whole organization, so a compromise reaches every application it protects. Apply this update the same day.
Key Details
- Affected Product
- Ibm Security Verify Access
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-502