CVE-2026-12005

Analyzed Analyzed - Analysis Complete

Remote Code Execution in IBM Security Verify Access

Publication date: 2026-08-12

Last updated on: 2026-08-17

Assigner: IBM Corporation

Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional operations by crafting a malicious HTTP request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-17

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-12005

EUVD

EUVD-2026-57534

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	security_verify_access	From 10.0.0 (inc) to 10.0.9.2 (inc)
ibm	security_verify_access	10.0.9.2
ibm	verify_identity_access	From 11.0 (inc) to 11.0.3 (inc)
ibm	verify_identity_access_container	From 11.0.0.0 (inc) to 11.0.3.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an input validation flaw in the management interface of IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3 (including the Container variant). It allows already privileged attackers to execute additional unauthorized operations by crafting malicious HTTP requests.

Detection Guidance

This vulnerability requires privileged access to exploit, so detection should focus on monitoring for unusual HTTP requests or administrative actions in IBM Security Verify Access or IBM Verify Identity Access logs. Check for unexpected POST requests to management interfaces or modifications to system configurations. Review logs for any crafted requests that attempt to bypass input validation.

Impact Analysis

If you use affected versions of IBM Security Verify Access or IBM Verify Identity Access, an attacker with existing privileged access could exploit this flaw to perform unauthorized actions, potentially leading to data breaches, system compromise, or further lateral movement within your network.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, which may violate compliance requirements under GDPR (data protection) or HIPAA (healthcare data privacy). Organizations using affected systems may face regulatory penalties or reputational damage if exploited.

Mitigation Strategies

Apply the latest security patches or updates provided by IBM for IBM Security Verify Access, IBM Verify Identity Access, or IBM Verify Identity Access Container. Ensure the management interface is not exposed to untrusted networks and restrict access to privileged users only.

Hi! I’m here to help you understand CVE-2026-12005. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70