IBM Fixes 22 Flaws in Verify Identity Access, Including Code Execution Without a Login

1Two Flaws Let an Attacker With No Login Run Code on IBM's Access Platform

IBM published fixes for 22 vulnerabilities on October 7, 2026, covering IBM Verify Identity Access 11 and IBM Security Verify Access 10. IBM sells Verify Identity Access as a self-managed identity and access management platform that applies authentication, authorization and identity policies for a company's workforce and customers. Two of the flaws, including CVE-2026-78401NewsGitLab Users With Agent Platform Access Could Run Commands on Its Self-Hosted AI GatewayGitLab fixed CVE-2026-90970 on October 2, 2026. A signed-in user with access to its Duo Agent Platform could use a crafted flow configuration to run…, let a remote attacker with no login run arbitrary code on the system. Two more let a remote attacker get past authentication checks. IBM scores the code execution flaws 9.8 and the authentication flaws 9.1 out of 10. In this bulletin the flaws sit in the system that enforces who may access what.

IBM Security Verify Access ... and IBM Verify Identity Access ... could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

IBM, Security Bulletin for CVE-2026-78401, October 7, 2026

IBM has released fixed versions, 11.0.3.2 for Verify Identity Access and 10.0.9.4 for Security Verify Access, and lists no workaround. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) records no known exploitation of any of the 22 flaws.

2IBM Says the Product May Not Enforce Authorization Correctly

Several of the remaining flaws touch the product's core job. One lets a signed-in attacker skip additional authentication steps. Another may allow the product's audit logGlossaryAudit TrailAn audit trail is a chronological record of system activities that provides documentary evidence of the sequence of actions taken by users, agents… to be forged. IBM scores that flaw 2.7 and rates it as needing high privileges. A third concerns authorization itself.

... may not enforce authorization correctly for some web servers.

IBM, Security Bulletin for CVE-2026-11930, October 7, 2026

The rest include code execution by an attacker with high privileges, which IBM also scores 9.1, as well as command injection by signed-in attackers, an arbitrary file write, cross-site scripting and denial of service. SolarWinds' September flawNewsSolarWinds Patched a Hardcoded Key in Access Rights ManagerA hardcoded static key let an unauthenticated attacker inside the network run code on SolarWinds Access Rights Manager, the software companies use to… sat in a product that grants access, while this one sits in a product that enforces it.

Source: IBM, Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessExternal Link Tohttps://www.ibm.com/support/pages/security-bulletin-security-vulnerabilities-have-been-found-ibm-verify-identity-access-and-ibm-security-verify-access-11, October 7, 2026.