CVE-2026-78399

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in IBM Security Verify Access

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: IBM Corporation

Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-78399

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	Security	Verify Access 10.0
IBM	Verify	Identity Access 11.0
IBM	Security	Verify Access Container 10.0
IBM	Verify	Identity Access Container 11.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3. An authenticated user can exploit it by sending a specially crafted HTTP query that improperly allocates system resources, causing the service to become unavailable.

Detection Guidance

This vulnerability involves improper resource allocation in IBM Security Verify Access and IBM Verify Identity Access. Detection requires monitoring for unusual resource consumption or service disruptions during HTTP queries. Check for increased CPU/memory usage or failed requests in logs. No specific commands are provided in the available context.

Impact Analysis

If exploited, this vulnerability could disrupt the availability of IBM Security Verify Access or IBM Verify Identity Access services. This may lead to service outages, preventing legitimate users from accessing critical authentication and identity management functions.

Compliance Impact

This vulnerability could lead to a denial of service, which may disrupt access to critical systems or data. For GDPR, this could impact availability of personal data processing systems, potentially violating Article 32 requirements for resilience. For HIPAA, it may affect the availability of protected health information systems, risking compliance with the Security Rule's integrity and availability standards.

Mitigation Strategies

Apply the latest IBM Security Verify Access or IBM Verify Identity Access patches immediately to address the improper resource allocation issue. Monitor network traffic for unusual HTTP query patterns that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-78399. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70