IBM has issued patches for 22 vulnerabilities in its Verify Identity Access and Security Verify Access platforms, including two critical flaws that allow unauthenticated remote code execution (RCE). These issues put both container and appliance deployments at risk of unmanaged exploitation.
Deserialization Bugs at the Top of the Risk List
The two most dangerous vulnerabilities—CVE-2026‐78401 and CVE-2026‐78406—both carry a CVSS score of 9.8. Their root cause is unsafe deserialization of untrusted data, enabling attackers to rebuild or execute harmful objects without any validation of input, and without needing valid credentials or user interactions.
While IBM’s advisory doesn’t identify exact vulnerable endpoints or confirm any attacks leveraging these flaws yet, it emphasizes that the severity arises from the ease of exploiting them remotely. Exploiting either deserialization flaw requires no prior authorization, making them particularly dangerous for exposed systems.
Other High-Severity Flaws and Broader Threat Landscape
Besides the deserialization vulnerabilities, three more serious issues have been rated at CVSS 9.1: one allowing authenticated remote code execution by a high-privilege user (CVE-2026-16916), another enabling bypass of security restrictions (CVE-2026-16823), and a third that permits authentication bypass vulnerabilities (CVE-2026-19491). These, while also serious, require different levels of access or interaction compared to the deserialization bugs.
Additional flaws addressed in the update include:
- Argument injection defects (CVE-2026-18740, CVE-2026-19482) that enable arbitrary commands or unauthorized actions;
- A path traversal vulnerability (CVE-2026-19493) letting remote actors write to unauthorized file locations;
- Cross-site scripting, SQL injection, cross-site request forgery, audit log forgery, incorrect authorization checks, authentication bypasses, and information disclosure, especially within the Snapshot Manager Container;
- Denial-of-service flaws tied to memory errors, recursive processing, or resource allocation;
- A stack buffer write issue requiring admin privileges via the local management interface.
What Systems Are Affected & What To Do
Appliance versions from Security Verify Access 10.0 through 10.0.9.2 and Verify Identity Access 11.0 through 11.0.3 are vulnerable. IBM recommends appliance users upgrade to Security Verify Access 10.0.9.3 or Verify Identity Access 11.0.3.1. Container users should follow IBM’s container download guidance to ensure they’re using the secured product images.
No workarounds or mitigations are indicated in the bulletin—upgrades are presented as the sole remediation on supported deployments. Both appliance and container setups are covered by IBM’s fixes.
The last few weeks have seen several related flaws in IBM’s identity and access products, including request smuggling, privilege escalation, and other serious vulnerabilities—these new patches are part of that ongoing security remediation effort.
What this means: organizations using Verify Access or Identity Access products need to prioritize immediate upgrades. The critical RCE bugs pose an especially high risk—no authentication needed to exploit—making the window for attack largely open until patched. Watch for IBM to clarify which endpoints exposure presents the biggest danger, and evaluate whether your deployment environment needs compensating controls while updating.
