Advisoriesby IbisIBMCVE-2026-13272
IBM Security Verify Access: remote attacker could perform operations as the...
No fix yet
IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Security Verify Access Product | >= 10.0.0, <= 10.0.9.2 Interim Fix 001 | No fix yet |
| Security Verify Access Container Product | >= 10.0.0, <= 10.0.9.2 Interim Fix 001 | No fix yet |
| Verify Identity Access Product | >= 11.0.0, <= 11.0.3 Interim Fix 001 | No fix yet |
| Verify Identity Access Container Product | >= 11.0.0, <= 11.0.3 Interim Fix 001 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Severity from
- CISA (its enrichment of the CVE record)
- Weakness
- CWE-1385