CVE-2026-19491
IBM Verify Identity Access and Security Verify Access authentication bypass allows unauthenticated remote access (CVE-2026-19491)
IBM Security Verify Access 10.0 to 10.0.9.2 and Verify Identity Access 11.0 to 11.0.3 are affected by an authentication bypass (CVE-2026-19491). A remote, unauthenticated attacker can gain high-impact access. Apply IBM's update; no fixed release is named.
What happened
IBM Security Verify Access and IBM Verify Identity Access are affected by an improper authentication vulnerability, recorded as CWE-287. The CVE record describes the consequence directly: a remote attacker can bypass authentication. In CVSS 3.1 terms this is a network attack with low complexity, requiring no privileges and no user interaction; confidentiality and integrity are rated high, while availability is not affected. The CVSS score is 9.1, critical.
There is no indication of active exploitation or public disclosure at the time of writing, and the CVE is not listed in CISA's KEV catalogue. The realistic exposure is a network-reachable Verify Access service, so internet-facing deployments should be treated as the highest priority.
Who is affected
The affected products and ranges are: IBM Security Verify Access 10.0 to 10.0.9.2 and Security Verify Access Container 10.0 to 10.0.9.2; IBM Verify Identity Access 11.0 to 11.0.3 and Verify Identity Access Container 11.0 to 11.0.3. Both conventional and containerised editions are in scope. Teams running these products should review them, especially where they are used in the authentication path for web applications and APIs, because a bypass here has direct consequences for access control.
What to do now
- Apply IBM's update. The CVE record confirms a fix is available but does not name the fixed release. Check the IBM support page listed for this CVE for the exact release and apply it to every affected instance, including container images.
- If you cannot patch immediately, reduce network exposure. Move authentication and management interfaces behind a VPN or trusted network segment rather than exposing them directly to the internet.
- Audit containerised deployments separately. The container editions are affected within the same ranges and are easy to miss in a patch cycle.
- After patching, verify that protected applications still prompt for authentication and that requests without valid credentials are denied.
How to detect it
No vendor-provided indicators of compromise are listed in the CVE record. Two practical checks remain useful. First, inventory all network-exposed Security Verify Access and Verify Identity Access instances, including containers, and treat any reachable from the internet as exposed until patched. Second, keep authentication and administrative session logs available for review while the update is rolled out, so unexpected successful access can be investigated promptly.
Beyond the patch
Because the weakness is reachable over the network without credentials, Virtual CISO Services (vCISO) can help you confirm which Verify Access deployments are actually exposed before an attacker does. Authentication bypass is also the kind of flaw a penetration test and hardening engagement finds first, so Implementation & Assessment Services can reduce the chance the next authentication change misses a check.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Security Verify Access | 10.0 – ≤ 10.0.9.2 | 10.0.9.3 |
| Verify Identity Access | 11.0 – ≤ 11.0.3 | 11.0.3.1 |
| Security Verify Access Container | 10.0 – ≤ 10.0.9.2 | No fixed version listed yet |
| Verify Identity Access Container | 11.0 – ≤ 11.0.3 | No fixed version listed yet |