IBM Verify Identity Access and Security Verify Access protection mechanism failure allows code execution (CVE-2026-16916)

What happened

IBM Security Verify Access and Verify Identity Access contain a protection mechanism failure (CWE-693). The CVE record describes this as allowing a remote authenticated attacker with high privileges to execute arbitrary code. The CVSS 3.1 vector means the attack is network-based, has low attack complexity, requires high privileges, needs no user interaction, and has changed scope with high confidentiality, integrity, and availability impact; the score is 9.1, critical. In practice, an attacker who already holds a privileged account on the identity platform can break out of the intended protection boundary and run code on the affected system, with the changed scope allowing compromise to extend beyond that component's own security scope.

The CVE record does not record active exploitation or public disclosure. No vendor workaround is listed.

Who is affected

Affected products and versions are: IBM Security Verify Access 10.0 through 10.0.9.2; IBM Verify Identity Access 11.0 through 11.0.3; IBM Security Verify Access Container 10.0 through 10.0.9.2; and IBM Verify Identity Access Container 11.0 through 11.0.3. These are identity and access management products; the container editions carry the same affected version ranges as their non-container counterparts. The CVE record names these ranges, and IBM's support bulletin is the authoritative source for the fixed releases.

What to do now

1. Check whether you run any affected version: Security Verify Access 10.0 to 10.0.9.2, Verify Identity Access 11.0 to 11.0.3, or the container editions of either.
2. Review IBM's support bulletin for the fixed release applicable to your product line. The CVE record says a fix is available but does not list the fixed version numbers, so confirm the exact release before deployment.
3. Apply IBM's fix to affected appliances and containers, prioritising systems that expose authentication or administrative functions.
4. Until patching is complete, restrict access to the identity platform's management interfaces, remove unused privileged accounts, and monitor administrative actions for unexpected changes.

How to detect it

The CVE record does not provide vendor-specific indicators of compromise. Because the flaw is triggered from an already privileged account, review the identity platform's audit logs for administrative actions you cannot correlate with approved change activity, and watch for new or unexpected processes, services or outbound connections on the affected appliances or containers.

Beyond the patch

Patching the identity platform is the immediate task, but the exposure is broader than one CVE. Because an attacker who reaches this flaw already has a privileged foothold, Managed Detection & Response is relevant: code execution and credential misuse leave traces in EDR and SIEM telemetry that active monitoring can catch. Tracking which IBM identity components you run and how quickly IBM's fix cycle closes this gap is also a Supply Chain Defense & Third-Party Risk exercise, particularly where the patching details must be confirmed from IBM's bulletin.