IBM Identity Products Face Critical Authentication Bypass Vulnerability CVE-2026-16823

A critical authentication bypass vulnerability has been identified in several IBM identity management products, exposing remote attackers to significant security risks. The flaw, tracked as CVE-2026-16823, allows unauthorized users to circumvent security restrictions due to improper authentication mechanisms within the affected software versions.

The National Vulnerability Database (NVD) has assigned a CVSS score of 9.1 to the issue, classifying it as Critical. The weakness is categorized under CWE-287, which denotes improper authentication. According to the NVD record, the vulnerability exists in IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3. The same versions of the containerized deployments, specifically IBM Security Verify Access Container and IBM Verify Identity Access Container, are also affected.

Vulnerability Context and Background

The core of the issue lies in how the specified IBM products handle authentication processes. Improper authentication allows a remote attacker to bypass security restrictions that are intended to limit access to authorized users only. This type of flaw is particularly dangerous because it does not require the attacker to have existing credentials or to exploit complex logic errors; rather, it exploits a fundamental failure in verifying user identity.

With a CVSS score of 9.1, the severity indicates that the vulnerability is easily exploitable and could result in a complete compromise of the affected system's integrity and confidentiality. The NVD description explicitly states that a remote attacker could leverage this flaw to bypass security restrictions. There is no mention in the current source material of a patch, fix, or update being available for these versions. Consequently, organizations running these specific versions are advised to assume the vulnerability is active and unpatched until further notice from the vendor.

Affected Products and Versions

The vulnerability impacts a specific range of IBM's identity access management solutions. The affected products include:

• IBM Security Verify Access: Versions 10.0 through 10.0.9.2
• IBM Verify Identity Access: Versions 11.0 through 11.0.3
• IBM Security Verify Access Container: Versions 10.0 through 10.0.9.2
• IBM Verify Identity Access Container: Versions 11.0 through 11.0.3

Organizations should verify their current installations against these version numbers. Any deployment running a version within these ranges is considered vulnerable to CVE-2026-16823. Products outside these version ranges are not listed as affected in the NVD record.

What should you do?

Given the critical nature of the vulnerability and the lack of confirmed fixes in the provided material, immediate defensive measures are necessary. Organizations should prioritize identifying all instances of the affected IBM products. Since no patch is confirmed, mitigation strategies must focus on limiting exposure and monitoring for exploitation attempts.