Critical RCE Flaw in IBM Security Verify Access Allows Unauthenticated Code Execution
A severe vulnerability in IBM access management software enables remote attackers to execute arbitrary code without credentials, posing immediate risk to exposed systems.
Key points
- CVE-2026-78401 is rated Critical with a CVSS score of 9.8.
- The flaw allows unauthenticated remote attackers to execute arbitrary code.
- IBM Security Verify Access and Verify Identity Access versions up to 11.0.3 are affected.
IBM has disclosed a critical remote code execution vulnerability in its Security Verify Access and Verify Identity Access products. The flaw, tracked as CVE-2026-78401, allows unauthenticated attackers to execute arbitrary code on affected systems by exploiting insecure deserialization of untrusted data.
At a glance
- CVE
- CVE-2026-78401
- Product
- IBM Security Verify Access
- CVSS
- 9.8 Critical
- Weakness
- insecure deserialization
- Exploited
- No known exploitation
The vulnerability carries a CVSS score of 9.8, classifying it as Critical severity. According to the National Vulnerability Database, the issue stems from CWE-502, which pertains to insecure deserialization. Because the attack requires no authentication, any instance of the affected software exposed to the internet is at immediate risk. An attacker can send crafted requests that trigger the deserialization process, leading to full control of the underlying system.
Context and Background
Insecure deserialization is a persistent threat in enterprise software architecture. It occurs when an application processes serialized data from an untrusted source without sufficient validation. When an application deserializes untrusted data, attackers can inject malicious objects that execute arbitrary commands. This weakness is frequently exploited in web applications and API endpoints that handle complex data structures.
IBM Security Verify Access and IBM Verify Identity Access are identity and access management solutions used to control user access to applications and data. These platforms are often deployed at the edge of networks, making them prime targets for external attackers. The ability to execute code remotely without credentials bypasses standard perimeter defenses, allowing adversaries to establish a foothold within the organization’s infrastructure.
Who Is Affected
The vulnerability impacts specific versions of IBM’s access management suite. IBM Security Verify Access versions 10.0 through 10.0.9.2 are affected. Additionally, IBM Verify Identity Access versions 11.0 through 11.0.3 contain the same flaw. The containerized versions of these products are also vulnerable. Specifically, IBM Security Verify Access Container up to version 10.0.9.2 and IBM Verify Identity Access Container up to version 11.0.3 are at risk. Organizations running these specific builds must verify their deployment status immediately.
What should you do?
Security teams should inventory their environments to identify any installations of the affected IBM software versions. Until a vendor update is available, administrators should restrict network access to these services, ensuring they are not directly exposed to untrusted networks. Monitoring logs for unusual deserialization activity or unexpected code execution can help detect exploitation attempts.
Background: Insecure deserialization
Look for base64-encoded parameters, unexpected object instantiation, or state changes that bypass authentication. Inspect input handling for unvalidated deserialization. Use allowlists for expected data types and verify integrity with digital signatures to prevent arbitrary code execution.
Read the full guide: Warning Signs of Insecure Deserialization in Web Applications
What to do and how to stay safe: IBM
- Audit your environment to confirm if you are running IBM Security Verify Access or Verify Identity Access versions listed as affected.
- Restrict network access to the vulnerable services to prevent unauthenticated remote connections from external networks.
- Monitor system logs and network traffic for signs of unauthorized code execution or unusual deserialization patterns.
- Prepare to apply the vendor’s security update once it is officially released and tested in your environment.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-78401?
The National Vulnerability Database rates CVE-2026-78401 with a CVSS score of 9.8, which is classified as Critical.
Which IBM products are affected by this vulnerability?
IBM Security Verify Access up to 10.0.9.2, IBM Verify Identity Access up to 11.0.3, and their respective container versions are affected.
Does this vulnerability require authentication to exploit?
No, the vulnerability allows a remote unauthenticated attacker to execute arbitrary code on the system.
