CVE-2026-16823
IBM Security Verify Access and Verify Identity Access authentication bypass (CVE-2026-16823)
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 have an authentication bypass (CVE-2026-16823). A remote, unauthenticated attacker can read or alter protected data. Apply IBM's update and restrict network exposure.
What happened
The CVE record describes CVE-2026-16823 as an improper authentication flaw in IBM Security Verify Access and IBM Verify Identity Access. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, meaning the vulnerability is reachable over the network, requires no credentials and no user interaction, and allows a remote attacker to compromise confidentiality and integrity. In practice, an attacker who can reach an affected instance may be able to read protected information and make unauthorised changes. The CVE record does not report exploitation or public disclosure, and there is no CISA KEV entry for this CVE.
Who is affected
The affected products are:
- IBM Security Verify Access and IBM Security Verify Access Container, 10.0 through 10.0.9.2
- IBM Verify Identity Access and IBM Verify Identity Access Container, 11.0 through 11.0.3
These are identity and access management components commonly placed where authentication is enforced for users and applications. If you run either version line in the ranges above, treat the system as affected.
What to do now
- Confirm your version. Check IBM Security Verify Access and IBM Verify Identity Access deployments, including container images, against the affected ranges above.
- Apply the vendor fix. IBM has made a fix available. The fixed version numbers are not listed in the CVE record, so obtain the corrective release from IBM's support page and apply it to each affected instance.
- If you cannot patch immediately, restrict network access to the affected systems. Keep management and runtime interfaces off the open internet, or place them behind a VPN.
- Review access to all instances. Assume any internet-reachable deployment is exposed until patched, and prioritise those with the fewest network controls.
How to detect it
The CVE record does not provide vendor indicators of compromise. Start by identifying every IBM Security Verify Access and Verify Identity Access instance that is reachable from the internet or an untrusted network segment, because unauthenticated network access is the precondition for this flaw. Monitor authentication events from unexpected IP addresses or accounts after the exposure window is known.
Beyond the patch
Beyond the patch, this is a reminder to treat identity and access management components as perimeter assets. Because this flaw is reachable over the network without credentials, start with Virtual CISO Services (vCISO) to map exposed instances and open entry points. Implementation & Assessment Services add penetration testing and hardening reviews that catch authentication flaws of this class before they become CVEs.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Security Verify Access | 10.0 – ≤ 10.0.9.2 | 10.0.9.3 |
| Verify Identity Access | 11.0 – ≤ 11.0.3 | 11.0.3.1 |
| Security Verify Access Container | 10.0 – ≤ 10.0.9.2 | No fixed version listed yet |
| Verify Identity Access Container | 11.0 – ≤ 11.0.3 | No fixed version listed yet |