# IBM Verify Access / Verify Identity Access: 22 Flaws Patched Incl. Unauthenticated RCE via Deserialization (CVE-2026-78401, CVE-2026-78406)

> IBM's 7 Oct 2026 bulletin patches 22 vulnerabilities in IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including container editions), two of them CVSS 9.8 unauthenticated remote code execution flaws caused by deserialization of untrusted data. No in-the-wild exploitation, public PoC, IOCs or attribution is documented, and no workarounds exist; updates to 10.0.9.3 and 11.0.3.1 are required.

- **Published:** 2026-10-12T12:27:05Z
- **Last reviewed:** 2026-10-12T12:27:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3352
- **ID:** TL-2026-3352
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-78401, CVE-2026-78406, CVE-2026-16916, CVE-2026-16823, CVE-2026-19491, CVE-2026-18740, CVE-2026-19482, CVE-2026-19493, CVE-2026-17189, CVE-2026-78399, CVE-2026-19498, CVE-2026-12109, CVE-2026-19878, CVE-2026-11936, CVE-2026-11939, CVE-2026-78388, CVE-2026-11930, CVE-2026-78407, CVE-2026-16830, CVE-2026-19494, CVE-2026-12091, CVE-2026-11888

## Description

IBM published a security bulletin (node 7291628) on 7 October 2026 covering 22 vulnerabilities across two access-management products: IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including container editions. Press coverage (Cyber Security News, 12 Oct 2026) also reports 22 flaws, matching the 22 CVE entries in the IBM bulletin.

The two most severe issues, CVE-2026-78401 and CVE-2026-78406, are both CWE-502 (deserialization of untrusted data) scored CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N). A remote, unauthenticated attacker can execute arbitrary code. Per the IBM bulletin table, CVE-2026-78401 affects both Verify Identity Access 11.0-11.0.3 and Security Verify Access 10.0-10.0.9.2, while CVE-2026-78406 affects Verify Identity Access 11.0-11.0.3 only. IBM does not publish the vulnerable endpoint, gadget chain or payload format, and no public exploit is documented.

Other high-impact flaws in Security Verify Access 10.0-10.0.9.2 include CVE-2026-16916 (CVSS 9.1, CWE-693 protection mechanism failure leading to authenticated code execution with scope change), CVE-2026-16823 and CVE-2026-19491 (CVSS 9.1 each, CWE-287 improper authentication allowing a remote unauthenticated attacker to bypass security restrictions/authentication), CVE-2026-18740 and CVE-2026-19482 (CVSS 8.8, CWE-88 argument injection by authenticated attackers, the latter enabling command execution), CVE-2026-19494 (CVSS 8.1, authentication restriction bypass), CVE-2026-19493 (CVSS 7.5, CWE-22 path traversal enabling unauthenticated arbitrary file write) and CVE-2026-17189 (CVSS 8.2, reflected XSS). Lower-severity items include SQL injection (CVE-2026-16830), CSRF (CVE-2026-78388), stored XSS in the web UI (CVE-2026-11936, CVE-2026-78407), authorization enforcement gaps (CVE-2026-11930), audit log tampering via argument injection (CVE-2026-11939), denial of service (CVE-2026-78399, CVE-2026-19498), memory safety issues (CVE-2026-12109, CVE-2026-12091), authentication workflow bypass (CVE-2026-19878) and a Snapshot Manager Container information disclosure (CVE-2026-11888).

Because Verify Access / Verify Identity Access products are identity and access-management (reverse proxy / authentication) infrastructure, compromise would put authentication decisions and session handling in an attacker's hands. As of 12 Oct 2026 the CVEs were not listed in CISA KEV, and the IBM bulletin does not state exploitation status. Remediation is to upgrade to Security Verify Access 10.0.9.3 or Verify Identity Access 11.0.3.1; IBM documents no workarounds.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1212 Exploitation for Credential Access
- T1556 Modify Authentication Process
- T1565.001 Stored Data Manipulation

## Sources

- [IBM Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://www.ibm.com/support/pages/node/7291628)
- [IBM Patches 22 Verify Access Flaws, Including Critical Remote Code Execution Bugs](https://cybersecuritynews.com/ibm-patches-22-verify-access-flaw/)
- [OpenCVE: CVE-2026-78401](https://app.opencve.io/cve/CVE-2026-78401)
- [OpenCVE: CVE-2026-78406](https://app.opencve.io/cve/CVE-2026-78406)
- [TheHackerWire: CVE-2026-78401 IBM Security Verify Access Deserialization Flaw Enables Unauthenticated RCE](https://www.thehackerwire.com/cve-2026-78401-ibm-security-verify-access-deserialization-flaw-enables-unauthenticated-remote-code-execution/)
- [SecurityOnline: IBM Verify Access Vulnerabilities](https://securityonline.info/ibm-verify-access-vulnerabilities/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3352