CVE-2026-11888
Ibm Security Verify Access: code injection can lead to information disclosure
- Risk score
- 51/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to an information disclosure attack.
- Affected
- Ibm Security Verify Access
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Ibm Security Verify Access: Amber, patch this week. IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
The flaws
- CVE-2026-11888: Code injection can lead to information disclosure (CVSS 7.5 · EPSS 0%)
- CVE-2026-78401: Unsafe deserialisation can lead to remote code execution (CVSS 9.8 · EPSS 1%)
- CVE-2026-78406: Unsafe deserialisation can lead to remote code execution (CVSS 9.8 · EPSS 0%)
- CVE-2026-16916: Remote code execution (CVSS 8.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Ibm Security Verify Access
Where it stands
- No known exploitation
Connects to
- Same weakness: Code injection (CWE-94). 239 other warnings in 30 days
- Same product: Earlier Ibm Security Verify Access warnings. 18 in the last 90 days
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to an information disclosure attack.
Last activity 8 Oct 2026. Patch Forecast updates every hour.