Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-19878

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3…

Risk score
42/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.2%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass additional authentication workflow steps.
Affected
Ibm Security Verify Access
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Ibm Security Verify AccessTHE FLAWSTHE FIXCVE-2026-19878IBM Security Verify Access10.0 through 10.0.9.2 and IBMVerify Identity Access 11.0…CVSS 6.5 · EPSS 0%CVE-2026-78401Unsafe deserialisation can leadto remote code executionCVSS 9.8 · EPSS 1%CVE-2026-78406Unsafe deserialisation can leadto remote code executionCVSS 9.8 · EPSS 0%CVE-2026-16916Remote code executionCVSS 8.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedIbm Security Verify AccessAMBER · PATCH THIS WEEKIbm SecurityVerify AccessIBM Security Verify Access 10.0through 10.0.9.2 and IBM VerifyIdentity Access 11.0 through11.0.3 could allow a remoteunauthenticated attacker toexecute arbitrary code on thesystem due to the…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-841 (CWE-841)8 other warnings in 30 days →Same productEarlier Ibm Security Verify Access warnings18 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Ibm Security Verify Access: Amber, patch this week. IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

The flaws

  • CVE-2026-19878: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3… (CVSS 6.5 · EPSS 0%)
  • CVE-2026-78401: Unsafe deserialisation can lead to remote code execution (CVSS 9.8 · EPSS 1%)
  • CVE-2026-78406: Unsafe deserialisation can lead to remote code execution (CVSS 9.8 · EPSS 0%)
  • CVE-2026-16916: Remote code execution (CVSS 8.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Ibm Security Verify Access

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium

References

Original description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass additional authentication workflow steps.

Last activity 8 Oct 2026. Patch Forecast updates every hour.