Critical Unauthenticated RCE Flaw Found in IBM Security Verify Access

IBM has disclosed a critical security vulnerability in its access management software that allows remote attackers to execute arbitrary code on affected systems. The flaw, identified as CVE-2026-78406, stems from the improper handling of untrusted data during deserialization processes within the application.

The National Vulnerability Database (NVD) rates the severity of this issue at 9.8, classifying it as Critical. According to the NVD record, the weakness is categorized under CWE-502, which pertains to the deserialization of untrusted data. This specific type of vulnerability often enables attackers to inject malicious objects that the application processes as valid data, leading to complete system compromise. Crucially, the exploit does not require the attacker to possess valid login credentials, making the attack surface significantly broader and the risk more immediate for organizations relying on these identity solutions.

Technical Context and Background

The vulnerability exists because the affected applications fail to adequately validate or sanitize data before deserializing it. Deserialization is a common process in software development where objects are converted into a format for storage or transmission and then reconstructed. When this process handles untrusted input without strict checks, it can allow an attacker to manipulate the object structure. In this case, the manipulation results in the execution of arbitrary code on the host system.

This type of flaw is particularly dangerous in identity and access management (IAM) products because these systems often sit at the perimeter of an organization’s network, handling sensitive authentication data. A successful exploit could grant an attacker full control over the server hosting the IBM software, potentially allowing them to pivot into the internal network, steal credentials, or disrupt access services entirely.

Who Is Affected

The vulnerability impacts specific versions of two primary IBM products. IBM Security Verify Access versions 10.0 through 10.0.9.2 are affected. Additionally, IBM Verify Identity Access versions 11.0 through 11.0.3 are vulnerable.

The issue also extends to the containerized deployments of these products. IBM Security Verify Access Container versions up to 10.0.9.2 and IBM Verify Identity Access Container versions up to 11.0.3 contain the same flaw. Organizations using any of these specific version ranges are exposed to the risk of remote code execution until they move to a patched version.

What should you do?

Security teams should immediately audit their environments to determine if they are running any of the affected versions of IBM Security Verify Access or IBM Verify Identity Access. Inventory checks should include both traditional installations and containerized deployments.

If an organization is using an affected version, they should restrict network access to the management interfaces of these systems to trusted IPs only, reducing the attack surface for unauthenticated remote attacks. Monitoring logs for unusual deserialization errors or unexpected process executions can help detect attempted exploits.