Patch Forecast
Amber warning
Patch this week.

CVE-2026-78406

Ibm Security Verify Access: unsafe deserialisation can lead to remote code execution

Risk score
72/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.5%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
Affected
Ibm Security Verify Access
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Ibm Security Verify AccessTHE FLAWSTHE FIXCVE-2026-78406Unsafe deserialisation can leadto remote code executionCVSS 9.8 · EPSS 0%CVE-2026-78401Unsafe deserialisation can leadto remote code executionCVSS 9.8 · EPSS 1%CVE-2026-16916Remote code executionCVSS 8.8 · EPSS 0%CVE-2026-19482IBM Security Verify Access10.0 through 10.0.9.2 and IBMVerify Identity Access 11.0…CVSS 8.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedIbm Security Verify AccessAMBER · PATCH THIS WEEKIbm SecurityVerify AccessIBM Security Verify Access 10.0through 10.0.9.2 and IBM VerifyIdentity Access 11.0 through11.0.3 could allow a remoteunauthenticated attacker toexecute arbitrary code on thesystem due to the…Where it standsNo known exploitationCONNECTS TOSame weaknessUnsafe deserialisation (CWE-502)249 other warnings in 30 days →Same productEarlier Ibm Security Verify Access warnings18 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Ibm Security Verify Access: Amber, patch this week. IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

The flaws

  • CVE-2026-78406: Unsafe deserialisation can lead to remote code execution (CVSS 9.8 · EPSS 0%)
  • CVE-2026-78401: Unsafe deserialisation can lead to remote code execution (CVSS 9.8 · EPSS 1%)
  • CVE-2026-16916: Remote code execution (CVSS 8.8 · EPSS 0%)
  • CVE-2026-19482: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through… (CVSS 8.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Ibm Security Verify Access

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in

References

Original description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

Last activity 8 Oct 2026. Patch Forecast updates every hour.