IBM Fixes Critical Auth Bypass in Security Verify Access, Verify Identity Access

IBM has addressed a critical security vulnerability in its identity management products that allows remote authenticated attackers to execute arbitrary code. The flaw, tracked as CVE-2026-16916, stems from a failure in the software’s protection mechanisms.

The National Vulnerability Database (NVD) rates the severity of this issue as Critical, assigning it a CVSS score of 9.1. The vulnerability is categorized under CWE-693, which refers to a protection mechanism failure. An attacker who has already authenticated to the system can exploit this weakness to run unauthorized code on the affected servers. This level of access could allow threat actors to compromise the integrity and confidentiality of the identity infrastructure.

Technical Context and Background

The vulnerability impacts specific ranges of IBM’s identity access products. According to the NVD record, the flaw exists in IBM Security Verify Access versions 10.0 through 10.0.9.2. It also affects IBM Verify Identity Access versions 11.0 through 11.0.3. The containerized versions of these products are similarly affected, specifically IBM Security Verify Access Container up to 10.0.9.2 and IBM Verify Identity Access Container up to 11.0.3.

The nature of the weakness is a protection mechanism failure. In software security, this typically means that a control designed to prevent unauthorized actions is either missing or bypassed. In this case, the failure allows an authenticated user to escalate their privileges or execute code they should not be able to run. Because the attacker must be authenticated, the threat model assumes an insider threat or a scenario where credentials have been compromised. However, the impact remains severe due to the potential for arbitrary code execution.

Affected Systems and Scope

Organizations relying on IBM’s identity governance solutions need to verify their current versions. The vulnerability is present in both the standard installations and the container-based deployments. This includes IBM Security Verify Access and IBM Verify Identity Access. If an organization is running any version prior to or including the maximum affected versions listed above, their systems are potentially exposed.

The distinction between the "Security Verify Access" and "Verify Identity Access" product lines is important for inventory checks. Both lines share the same vulnerability range in this specific CVE. Administrators should check both their primary identity servers and any containerized instances used for scaling or microservices architectures. Failure to update these systems leaves a critical entry point for attackers who have gained initial access to the identity platform.

What should you do?

Administrators should immediately audit their environments to identify if they are running the affected versions of IBM Security Verify Access or IBM Verify Identity Access. Inventory checks should include both virtual machine deployments and containerized environments. Monitor authentication logs for unusual activity, particularly from accounts that may have been compromised, as the attacker requires valid credentials to exploit this flaw. Once the vendor provides an update, apply the patch promptly to close the protection mechanism failure.