CVE-2026-11904

Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in IBM Verify Identity Access

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: IBM Corporation

Description

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-11904

EUVD

EUVD-2026-51248

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	verify_identity_access	From 11.0 (inc) to 11.0.2 (inc)
ibm	security_verify_access	From 10.0 (inc) to 10.0.9.1 (inc)
ibm	verify_identity_access_container	From 11.0 (inc) to 11.0.2 (inc)
ibm	security_verify_access_container	From 10.0 (inc) to 10.0.9.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

Executive Summary

IBM Verify Identity Access and IBM Security Verify Access versions 10.0 through 10.0.9.1 and 11.0 through 11.0.2 may expose sensitive information via detailed technical error messages sent to a remote attacker's browser. This information could aid further attacks on the system.

Detection Guidance

This vulnerability involves sensitive technical error messages being exposed in browser responses. To detect it, monitor HTTP responses for detailed error messages from IBM Verify Identity Access or IBM Security Verify Access endpoints. Check web server logs for error responses containing stack traces or internal details. Use tools like curl to inspect responses for verbose error messages when accessing affected endpoints.

Impact Analysis

An attacker could gather technical details from error messages to exploit weaknesses in the system, potentially leading to unauthorized access or data breaches. The impact includes information disclosure but does not directly allow code execution or system modification.

Compliance Impact

This vulnerability may violate compliance requirements by exposing sensitive data through error messages, which could lead to unauthorized access or data leaks. Organizations must ensure error messages do not reveal technical details to maintain GDPR, HIPAA, or other regulatory standards.

Mitigation Strategies

Apply the latest security patches or updates provided by IBM for IBM Verify Identity Access or IBM Security Verify Access. Review error messages to ensure they do not expose sensitive technical details that could aid attackers.

Hi! I’m here to help you understand CVE-2026-11904. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70