Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-12T20:17:33.530Z",
  "pubdate": "2026-08-12T20:17:33.530Z",
  "executiveSummary": "A format string injection vulnerability exists within the management interface of IBM Security Verify Access and IBM Verify Identity Access. This security flaw enables remote attackers to trigger a denial of service condition and achieve unauthorized information disclosure. The vulnerability affects multiple versions of IBM Security Verify Access (10.0 through 10.0.9.2), IBM Verify Identity Access (11.0 through 11.0.3), and IBM Verify Identity Access Container (11.0 through 11.0.3). Successful exploitation requires an attacker to craft and transmit a malicious HTTP request directed at the vulnerable management interface. The presence of this vulnerability introduces significant risk to system availability and data confidentiality, as improper handling of format string specifiers allows memory contents to be read or corrupted. No complex privileges are inherently mandated by the description beyond the ability to reach the management interface and deliver the malformed payload. Organizations utilizing the affected software lines must apply official vendor patches or implement rigorous access controls around the management interface to neutralize potential exploitation vectors and maintain operational integrity.",
  "technicalDetails": "The vulnerability resides in the management interface component of the affected IBM products, specifically stemming from unsafe handling of user-supplied input passed into formatting functions. In secure software development, format string vulnerabilities occur when untrusted data is directly interpreted as a format specifier by standard output or logging functions (such as printf-family functions in C/C++ implementations). Without proper input sanitization or the enforced use of constant format strings, an attacker can supply format specifier characters—such as percent signs (%x, %s, %n)—within an HTTP request handled by the management interface. When the application processes the crafted request, the underlying formatting engine parses these injected specifiers, reading from or writing to arbitrary memory locations based on the stack state or argument pointers.\nThe step-by-step attack flow begins with the malicious actor identifying the network-exposed management interface of the target system. The attacker crafts an HTTP request containing malicious format string payloads embedded within vulnerable parameters or headers processed by the management subsystem. Upon receipt, the application passes this unsanitized input to the vulnerable function. As the function evaluates the format string, the `%s` or `%x` specifiers instruct the application to read memory addresses directly from the stack, potentially returning sensitive internal data structures, session tokens, or configuration details back to the attacker, thereby achieving information disclosure. Furthermore, utilizing the `%n` specifier or inducing memory access violations can corrupt critical memory regions or crash the process entirely, resulting in a denial of service condition.\nThe vulnerability impacts IBM Security Verify Access versions 10.0 through 10.0.9.2, IBM Verify Identity Access versions 11.0 through 11.0.3, and IBM Verify Identity Access Container versions 11.0 through 11.0.3. The attack vector is network-based, targeting the administrative or management interface exposed by these products. Exploitation relies purely on input validation failures within the software logic, requiring no elevated authentication state if the endpoint improperly parses unauthenticated or pre-authentication request components, or leveraging low-privileged access where applicable."
}