IBM Patches 22 Verify Access Flaws, Including Critical Remote Code Execution Bugs

IBM patched 22 vulnerabilities in Verify Identity Access and Security Verify Access, including two critical flaws allowing unauthenticated remote code execution across appliance and container deployments.

The most severe bugs, CVE-2026-78401 and CVE-2026-78406, each carry a CVSS score of 9.8. Both involve deserializing untrusted data, a process where software rebuilds stored or transmitted data into objects without properly checking whether it is safe.

The publicly listed advisory for CVE-2026-78401 confirms the risk of unauthenticated remote code execution. IBM rates both deserialization bugs as network-accessible attacks with low complexity, no required privileges, and no user interaction.IBM Patches 22 Verify Access Flaws, Including Critical Remote Code Execution Bugs.

Successful exploitation could seriously affect data confidentiality, integrity, and service availability. However, the supplied bulletin does not identify vulnerable endpoints, describe an exploit chain, or report confirmed attacks.

These critical flaws deserve close attention because attackers do not need a valid account to reach the vulnerable code. Their severity reflects potential impact and ease of attack, not evidence that exploitation has already occurred.

IBM Patches 22 Verify Access Flaws

Three additional vulnerabilities carry scores of 9.1. CVE-2026-16916 allows an authenticated, high-privilege remote attacker to execute arbitrary code because a protection mechanism fails.

CVE-2026-16823 enables attackers to bypass security restrictions, while CVE-2026-19491 allows authentication bypass. Unlike the deserialization bugs, these issues require different access and have different outcomes.

The update follows earlier IBM Identity and Verify Access vulnerabilities reported by Cyber Security News, which covered request smuggling, privilege escalation, and other security weaknesses in the same product family. Do not confuse those earlier fixes with this October patch release.

The bulletin also addresses CVE-2026-18740 and CVE-2026-19482, both rated 8.8. These argument injection flaws let authenticated remote attackers perform unauthorized actions or execute arbitrary commands. CVE-2026-19493, rated 7.5, allows a remote attacker to write files through path traversal.

Other vulnerabilities include cross-site scripting that could expose credentials within trusted sessions, SQL injection that could modify data or disrupt services, and cross-site request forgery that could trigger unauthorized actions.

Additional fixes address audit log forgery, incorrect authorization checks, authentication workflow bypass, and information disclosure in the Snapshot Manager Container. Several denial-of-service flaws affect resource allocation, recursive processing, and memory reads.

IBM also patched a stack buffer write issue that requires administrative privileges and access to the local management interface. Earlier IBM Security Verify command execution coverage provides related background on previously patched appliance flaws.

Affected releases include IBM Security Verify Access and its Container edition from 10.0 through 10.0.9.2. IBM Verify Identity Access and its Container edition are affected from 11.0 through 11.0.3.

IBM directs appliance customers to install Verify Identity Access 11.0.3.1 or Security Verify Access 10.0.9.3 through its Fix Central download links.

Container customers should follow IBM’s container download guidance, which identifies product images and registry locations. IBM renamed Security Verify Access to Verify Identity Access starting with version 11.0.0.

The bulletin lists no workarounds or mitigations. IBM encourages customers to update promptly, and the bulletin lists the supplied fixes as the stated remediation for these vulnerabilities across affected supported deployments.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post IBM Patches 22 Verify Access Flaws, Including Critical Remote Code Execution Bugs appeared first on Cyber Security News.