IBM Fixes Two Critical RCE Flaws in Verify Access Appliance and Container Deployments
IBM released patches for 22 vulnerabilities in Verify Access, addressing two critical remote code execution bugs that require no authentication.
Key points
- IBM patched 22 flaws in Verify Identity Access and Security Verify Access, including two critical RCE vulnerabilities.
- CVE-2026-78401 and CVE-2026-78406 both carry CVSS scores of 9.8 and involve unsafe deserialization of untrusted data.
- The update also fixes three vulnerabilities rated 9.1, two rated 8.8, and several other issues including SQL injection and XSS.
IBM has released security updates for Verify Identity Access and Security Verify Access to address 22 distinct vulnerabilities. According to Cyber Security News, the most significant fixes resolve two critical flaws that allow unauthenticated remote code execution across both appliance and container deployments. These issues pose an immediate risk to organizations relying on these identity management solutions.
The two most severe bugs are identified as CVE-2026-78401 and CVE-2026-78406. Each vulnerability carries a CVSS score of 9.8, reflecting the high impact and ease of exploitation. Both flaws stem from the software deserializing untrusted data without properly validating its safety. This process rebuilds stored or transmitted data into objects, potentially allowing attackers to execute arbitrary code.
Technical Details and Severity Ratings
IBM rates both deserialization bugs as network-accessible attacks with low complexity. Exploitation requires no prior privileges and no user interaction, meaning attackers can trigger these flaws remotely without logging in. Successful exploitation could compromise data confidentiality, integrity, and service availability. The publicly listed advisory for CVE-2026-78401 confirms the risk of unauthenticated remote code execution.
Three additional vulnerabilities in this release carry CVSS scores of 9.1. CVE-2026-16916 allows an authenticated, high-privilege remote attacker to execute arbitrary code due to a failed protection mechanism. CVE-2026-16823 enables attackers to bypass security restrictions, while CVE-2026-19491 allows for authentication bypass. These issues require different access levels and produce different outcomes than the critical deserialization flaws.
Scope of Affected Components
The bulletin also addresses two argument injection flaws, CVE-2026-18740 and CVE-2026-19482, both rated 8.8. These vulnerabilities allow authenticated remote attackers to perform unauthorized actions or execute arbitrary commands. Additionally, CVE-2026-19493, rated 7.5, permits remote attackers to write files through path traversal. Other fixed issues include cross-site scripting that could expose credentials, SQL injection that could modify data, and cross-site request forgery flaws.
This October patch release is distinct from earlier IBM Identity and Verify Access vulnerabilities previously reported by Cyber Security News. Those earlier reports covered request smuggling, privilege escalation, and other weaknesses in the same product family. Administrators should not confuse those previous fixes with this specific update cycle.
What should you do?
The supplied bulletin does not identify specific vulnerable endpoints, describe an exploit chain, or report confirmed attacks in the wild. The severity ratings reflect potential impact and ease of attack rather than evidence that exploitation has already occurred. However, because the critical flaws require no authentication, they deserve close attention from security teams managing these deployments.
What to do and how to stay safe: IBM
- Verify whether your environment runs Verify Identity Access or Security Verify Access and apply the latest patches immediately.
- Monitor network logs for unusual deserialization activity or unauthorized remote code execution attempts on identity management appliances.
- Restrict network access to Verify Access components to trusted segments to reduce the attack surface for unauthenticated threats.
- Review authentication logs for signs of bypass attempts related to CVE-2026-16823 and CVE-2026-19491.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the most critical CVEs in this IBM Verify Access update?
The most critical vulnerabilities are CVE-2026-78401 and CVE-2026-78406, both rated 9.8 and allowing unauthenticated remote code execution.
Do these critical flaws require user authentication to exploit?
No, IBM rates both deserialization bugs as requiring no privileges and no user interaction for network-accessible attacks.
Are there confirmed attacks using these vulnerabilities?
The supplied bulletin does not report confirmed attacks or describe an exploit chain for these flaws.
