CVE-2026-11937

Analyzed Analyzed - Analysis Complete

Reverse Proxy DoS in IBM Security Verify Access

Publication date: 2026-08-12

Last updated on: 2026-08-17

Assigner: IBM Corporation

Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 and IBM Security Verify Access Container 10.0 through 10.0.9.2 Reverse Proxy in certain configurations is vulnerable to a denial of service attack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-17

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-11937

EUVD

EUVD-2026-57537

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	security_verify_access	From 10.0.0 (inc) to 10.0.9.2 (inc)
ibm	security_verify_access	10.0.9.2
ibm	verify_identity_access	From 11.0 (inc) to 11.0.3 (inc)
ibm	verify_identity_access_container	From 11.0.0.0 (inc) to 11.0.3.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

IBM Security Verify Access and IBM Verify Identity Access Reverse Proxy in certain configurations are vulnerable to a denial of service attack due to improper handling of requests.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. IBM Security Verify Access and related products may require monitoring for unusual traffic patterns or service disruptions, but exact detection steps are not detailed here.

Impact Analysis

This vulnerability could allow an attacker to disrupt services by causing the Reverse Proxy to become unavailable, leading to service outages for legitimate users.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with GDPR, HIPAA, or other standards. The vulnerability is a denial of service affecting IBM Security Verify Access and related products, which could indirectly impact compliance by disrupting access to critical systems handling sensitive data.

Mitigation Strategies

Apply the latest patches or updates provided by IBM for IBM Security Verify Access or IBM Verify Identity Access to address the denial of service vulnerability. Review and adjust Reverse Proxy configurations to limit exposure. Monitor IBM security advisories for updates.

Hi! I’m here to help you understand CVE-2026-11937. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70