CVE-2026-8861

Analyzed Analyzed - Analysis Complete

IBM Security Verify Information Disclosure Vuln

Publication date: 2026-07-17

Last updated on: 2026-08-11

Assigner: IBM Corporation

Description

IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-08-11

Generated

2026-08-27

AI Q&A

2026-07-17

EPSS Evaluated

2026-08-26

NVD

CVE-2026-8861

EUVD

EUVD-2026-45268

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	security_verify_access_container	From 10.0.0.0 (inc) to 10.0.9.1 (inc)
ibm	security_verify_access	From 10.0.0 (inc) to 10.0.9.2 (exc)
ibm	verify_identity_access	From 11.0 (inc) to 11.0.3 (exc)
ibm	verify_identity_access_container	From 11.0.0.0 (inc) to 11.0.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

Executive Summary

IBM Security Verify may expose sensitive information through detailed technical error messages displayed in the browser. This information could be exploited by attackers to launch further attacks on the system.

Detection Guidance

This vulnerability involves IBM Security Verify exposing detailed technical error messages that could reveal sensitive information. To detect it, monitor web server responses for verbose error messages or stack traces. Check application logs for unusual error details being returned to clients. Inspect network traffic for responses containing internal system information.

Impact Analysis

An attacker could use the exposed technical details to craft more targeted attacks against your IBM Security Verify system, potentially leading to unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, which may violate GDPR or HIPAA requirements for protecting personal or health information.

Mitigation Strategies

Review and restrict detailed technical error messages returned in browser responses to avoid exposing sensitive information. Ensure error messages are generic and do not reveal system details.

Hi! I’m here to help you understand CVE-2026-8861. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70