CVE-2026-109126High· 8.8▾ TwilightIBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
0.2% → 0.2%
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.
verify_identity_access 11.0.3.1security_verify_access 10.0.9.3IBM encourages customers to update their systems promptly.
Appliance:
Affected Products
Fix availability
IBM Verify Identity Access
Download IBM Verify Identity Access v11.0.3.2 https://www.ibm.com/support/fixcentral/swg/selectFix
IBM Security Verify Access
Download IBM Security Verify Access v10.0.9.4 https://www.ibm.com/support/fixcentral/swg/selectFixes
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-53709Critical· 9.8MCP Context Forge is an MCP gateway and administrative platform
CVE-2026-11934High· 7.2IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.
CVE-2026-12101High· 8.1IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.
CVE-2026-11928Critical· 9.8IBM Verify Identity Access is vulnerable to a buffer overflow attack.
CVE-2026-11926High· 7.5IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.
CVE-2026-11929High· 7.5IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.