Threat reportVulnerabilityTL-2026-3352
IBM Verify Access / Verify Identity Access: 22 Flaws Patched Incl. Unauthenticated RCE via Deserialization (CVE-2026-78401, CVE-2026-78406)
IBM Verify Access / Verify Identity Access (TL-2026-3352) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-12. It has no confirmed attribution, affects IBM IBM Security Verify Access (incl. container editions), references 22 CVEs (CVE-2026-78401, CVE-2026-78406, CVE-2026-16916), maps to 5 MITRE ATT&CK techniques (T1059, T1190, T1212), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 22Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-3352
- Threat ID
- TL-2026-3352
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
How IBM Verify Access / Verify Identity Access works
IBM's 7 Oct 2026 bulletin patches 22 vulnerabilities in IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including container editions), two of them CVSS 9.8 unauthenticated remote code execution flaws caused by deserialization of untrusted data. No in-the-wild exploitation, public PoC, IOCs or attribution is documented, and no workarounds exist; updates to 10.0.9.3 and 11.0.3.1 are required.
IBM published a security bulletin (node 7291628) on 7 October 2026 covering 22 vulnerabilities across two access-management products: IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including container editions. Press coverage (Cyber Security News, 12 Oct 2026) also reports 22 flaws, matching the 22 CVE entries in the IBM bulletin.
The two most severe issues, CVE-2026-78401 and CVE-2026-78406, are both CWE-502 (deserialization of untrusted data) scored CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N). A remote, unauthenticated attacker can execute arbitrary code. Per the IBM bulletin table, CVE-2026-78401 affects both Verify Identity Access 11.0-11.0.3 and Security Verify Access 10.0-10.0.9.2, while CVE-2026-78406 affects Verify Identity Access 11.0-11.0.3 only. IBM does not publish the vulnerable endpoint, gadget chain or payload format, and no public exploit is documented.
Other high-impact flaws in Security Verify Access 10.0-10.0.9.2 include CVE-2026-16916 (CVSS 9.1, CWE-693 protection mechanism failure leading to authenticated code execution with scope change), CVE-2026-16823 and CVE-2026-19491 (CVSS 9.1 each, CWE-287 improper authentication allowing a remote unauthenticated attacker to bypass security restrictions/authentication), CVE-2026-18740 and CVE-2026-19482 (CVSS 8.8, CWE-88 argument injection by authenticated attackers, the latter enabling command execution), CVE-2026-19494 (CVSS 8.1, authentication restriction bypass), CVE-2026-19493 (CVSS 7.5, CWE-22 path traversal enabling unauthenticated arbitrary file write) and CVE-2026-17189 (CVSS 8.2, reflected XSS). Lower-severity items include SQL injection (CVE-2026-16830), CSRF (CVE-2026-78388), stored XSS in the web UI (CVE-2026-11936, CVE-2026-78407), authorization enforcement gaps (CVE-2026-11930), audit log tampering via argument injection (CVE-2026-11939), denial of service (CVE-2026-78399, CVE-2026-19498), memory safety issues (CVE-2026-12109, CVE-2026-12091), authentication workflow bypass (CVE-2026-19878) and a Snapshot Manager Container information disclosure (CVE-2026-11888).
Because Verify Access / Verify Identity Access products are identity and access-management (reverse proxy / authentication) infrastructure, compromise would put authentication decisions and session handling in an attacker's hands. As of 12 Oct 2026 the CVEs were not listed in CISA KEV, and the IBM bulletin does not state exploitation status. Remediation is to upgrade to Security Verify Access 10.0.9.3 or Verify Identity Access 11.0.3.1; IBM documents no workarounds.
MITRE ATT&CK techniques used in TL-2026-3352
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access
defense-impairment
T1556 Modify Authentication Process
Impact
Affected products and versions in IBM Verify Access / Verify Identity Access
Remediation for IBM Verify Access / Verify Identity Access
Patches
- IBM Security Verify Access v10.0.9.3
- IBM Verify Identity Access v11.0.3.1
Immediate actions
- Upgrade IBM Security Verify Access to 10.0.9.3 and IBM Verify Identity Access to 11.0.3.1, including container deployments
- Restrict network exposure of Verify Access / Verify Identity Access management and web interfaces to trusted networks until patched
- Review authentication, audit and web server logs on affected appliances for anomalous requests since early October 2026
Workarounds
- None documented by IBM; updating is required
Longer-term hardening
- Inventory all Verify Access / Verify Identity Access instances and container images and track IBM security bulletins
- Forward appliance audit logs to a SIEM so audit-log tampering (CVE-2026-11939) is detectable off-box
- Enforce least-privilege administrative access and MFA for appliance administrators
CVEs associated with IBM Verify Access / Verify Identity Access
- CVE-2026-78401
- CVE-2026-78406
- CVE-2026-16916
- CVE-2026-16823
- CVE-2026-19491
- CVE-2026-18740
- CVE-2026-19482
- CVE-2026-19493
- CVE-2026-17189
- CVE-2026-78399
- CVE-2026-19498
- CVE-2026-12109
- CVE-2026-19878
- CVE-2026-11936
- CVE-2026-11939
- CVE-2026-78388
- CVE-2026-11930
- CVE-2026-78407
- CVE-2026-16830
- CVE-2026-19494
- CVE-2026-12091
- CVE-2026-11888
Weaknesses (CWE) in IBM Verify Access / Verify Identity Access
CWE-502, CWE-693, CWE-79, CWE-770, CWE-674, CWE-787, CWE-841, CWE-88, CWE-287, CWE-352
Timeline of IBM Verify Access / Verify Identity Access
- IBM directs container-edition customers to updated images via its documentation portal; bulletin lists all 22 CVEs scored with CVSS v3.1 vectors
- IBM makes fixes available: Security Verify Access 10.0.9.3 and Verify Identity Access 11.0.3.1; no workarounds documented
- IBM publishes security bulletin 7291628 covering 22 vulnerabilities in IBM Security Verify Access and IBM Verify Identity Access
- CVE records for CVE-2026-78401 (CVSS 9.8, CWE-502) and related flaws appear in public CVE aggregators
- No confirmed in-the-wild exploitation or public PoC documented; CVE-2026-78401 not listed in CISA KEV per aggregator reporting
- Cyber Security News reports IBM patched 22 Verify Access flaws including two critical unauthenticated RCE bugs
Sources cited for IBM Verify Access / Verify Identity Access
- IBM Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- IBM Patches 22 Verify Access Flaws, Including Critical Remote Code Execution Bugs
- OpenCVE: CVE-2026-78401
- OpenCVE: CVE-2026-78406
- TheHackerWire: CVE-2026-78401 IBM Security Verify Access Deserialization Flaw Enables Unauthenticated RCE
- SecurityOnline: IBM Verify Access Vulnerabilities
Detection coverage for TL-2026-3352
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3352 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.