Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-12109

Ibm Security Verify Access: out-of-bounds write can lead to remote code execution

Risk score
45/100
CVSS
7.2 v3.1
Exploit chance (30 days)
0.2%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attacker with administrative privileges and access to the local management interface to execute arbitrary code due to an unbounded write to a fixed-size stack buffer.
Affected
Ibm Security Verify Access
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Ibm Security Verify AccessTHE FLAWSTHE FIXCVE-2026-12109Out-of-bounds write can leadto remote code executionCVSS 7.2 · EPSS 0%CVE-2026-78401Unsafe deserialisation can leadto remote code executionCVSS 9.8 · EPSS 1%CVE-2026-78406Unsafe deserialisation can leadto remote code executionCVSS 9.8 · EPSS 0%CVE-2026-16916Remote code executionCVSS 8.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedIbm Security Verify AccessAMBER · PATCH THIS WEEKIbm SecurityVerify AccessIBM Security Verify Access 10.0through 10.0.9.2 and IBM VerifyIdentity Access 11.0 through11.0.3 could allow a remoteunauthenticated attacker toexecute arbitrary code on thesystem due to the…Where it standsNo known exploitationCONNECTS TOSame weaknessOut-of-bounds write (CWE-787)258 other warnings in 30 days →Same productEarlier Ibm Security Verify Access warnings18 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Ibm Security Verify Access: Amber, patch this week. IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

The flaws

  • CVE-2026-12109: Out-of-bounds write can lead to remote code execution (CVSS 7.2 · EPSS 0%)
  • CVE-2026-78401: Unsafe deserialisation can lead to remote code execution (CVSS 9.8 · EPSS 1%)
  • CVE-2026-78406: Unsafe deserialisation can lead to remote code execution (CVSS 9.8 · EPSS 0%)
  • CVE-2026-16916: Remote code execution (CVSS 8.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Ibm Security Verify Access

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.2 high

References

Original description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attacker with administrative privileges and access to the local management interface to execute arbitrary code due to an unbounded write to a fixed-size stack buffer.

Last activity 8 Oct 2026. Patch Forecast updates every hour.