Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 is vulnerable to a denial of service attack.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T21:17:34.523Z",
  "pubdate": "2026-08-12T21:17:34.523Z",
  "executiveSummary": "A denial of service vulnerability has been identified affecting IBM Security Verify Access 10.0 through 10.0.9.2, IBM Verify Identity Access 11.0 through 11.0.3, and IBM Verify Identity Access Container 11.0 through 11.0.3. This vulnerability allows remote attackers to disrupt service availability by exhausting system resources or triggering application instability.\nThe flaw exposes critical authentication and identity management infrastructure components to potential denial of service conditions, posing significant risks to business continuity and user access management. Successful exploitation compromises the availability of the affected access management platforms, preventing legitimate users from authenticating or accessing protected enterprise resources.\nThe risk implications involve complete service disruption of the targeted identity provider instances, leading to operational downtime. Attacker capabilities typically involve network-based interactions with the vulnerable endpoints to trigger the denial of service condition. Exploitation conditions rely on the accessibility of the affected software components exposed to network traffic handling client requests.",
  "technicalDetails": "The vulnerability resides within the request processing logic of IBM Security Verify Access 10.0 through 10.0.9.2, IBM Verify Identity Access 11.0 through 11.0.3, and IBM Verify Identity Access Container 11.0 through 11.0.3. The root cause stems from improper handling of specific client-supplied inputs or malformed network payloads destined for the core access management and identity federation components.\nExploitation occurs when an unauthenticated or authenticated remote attacker crafts and transmits specialized network payloads designed to trigger resource exhaustion or application faults within the vulnerable component. Upon receipt, the application fails to adequately validate, bound, or exception-handle the incoming data structures, resulting in excessive CPU consumption, memory leakage, thread starvation, or an unhandled exception that causes the service process to crash.\nThe attack flow begins with network reconnaissance to identify exposed endpoints running the vulnerable versions of IBM Security Verify Access or IBM Verify Identity Access. The attacker then initiates connection sequences and transmits the malicious payload over the established protocol channels. As the application attempts to parse and process the input, the underlying processing routines enter an inefficient state or encounter fatal runtime errors.\nThe affected components handle core authentication, federation, and reverse proxy functions responsible for intercepting and evaluating web traffic. Because these services sit at the perimeter of enterprise security architectures, their destabilization directly impacts the entire security ecosystem. The network exposure is broad, typically affecting standard service ports exposed to internal or external client traffic depending on deployment topologies. The post-exploitation impact is strictly localized to denial of service, denying access to dependent applications and services without granting unauthorized data access or remote code execution capabilities."
}