Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-12T20:17:33.940Z",
  "pubdate": "2026-08-12T20:17:33.940Z",
  "executiveSummary": "A command injection vulnerability exists in IBM Security Verify Access 10.0 through 10.0.9.2, IBM Verify Identity Access 11.0 through 11.0.3, and IBM Verify Identity Access Container 11.0 through 11.0.3.\nThe vulnerability stems from improper validation of user-supplied input provided by an authenticated administrator.\nAn authenticated attacker with administrative privileges can exploit this flaw to execute unauthorized system commands that exceed their intended entitlements.\nThe impact of successful exploitation includes unauthorized privilege escalation, execution of arbitrary commands at the operating system level, and potential compromise of the underlying host system or container environment.\nExploitation requires administrative-level access and the ability to supply crafted input to the vulnerable component.\nOrganizations utilizing the affected software face significant risk to system integrity and confidentiality if administrative accounts are compromised or untrusted administrators abuse their access parameters.",
  "technicalDetails": "The vulnerability is rooted in the insecure handling and lack of strict input sanitization or validation mechanisms for parameters supplied by administrators within IBM Security Verify Access and IBM Verify Identity Access product families.\nThe vulnerable component fails to properly neutralize, filter, or escape special characters within user-supplied input before passing the data to underlying system shells or execution routines.\nAffected versions include IBM Security Verify Access 10.0 through 10.0.9.2, IBM Verify Identity Access 11.0 through 11.0.3, and IBM Verify Identity Access Container 11.0 through 11.0.3.\nTo execute an attack, an actor must first authenticate to the administrative interface with valid administrator credentials, satisfying the initial authentication and privilege requirements.\nDuring administrative workflows, the attacker injects malicious command sequences or metacharacters into input fields or API endpoints that are subsequently processed by the backend execution engine.\nBecause input validation is absent or improperly implemented, the backend application interprets the malicious input as executable system commands rather than literal data strings.\nThe payload executes with the privileges of the underlying service account or process executing the administrative functions, typically resulting in arbitrary command execution at the operating system or container layer.\nPost-exploitation impact includes unauthorized modification of system configurations, access to sensitive data stores, installation of backdoors, and lateral movement within the network architecture depending on the privileges of the execution context."
}