CVE-2026-78401
IBM Security Verify Access and IBM Verify Identity Access unsafe deserialisation allows remote code execution (CVE-2026-78401)
IBM Security Verify Access 10.0–10.0.9.2 and IBM Verify Identity Access 11.0–11.0.3 are affected by unsafe deserialisation that lets an unauthenticated remote attacker run arbitrary code. Apply IBM's fix; no exploitation is currently confirmed.
What happened
IBM Security Verify Access and IBM Verify Identity Access deserialise untrusted data in a way that lets a remote attacker send a crafted request and execute arbitrary code on the affected system. The flaw (CWE-502) is reachable over the network without authentication or user interaction, and a successful exploit gives the attacker full control of the system — read and modify data, and disrupt availability. The CVSS 3.1 score is 9.8, critical.
The CVE record does not report active exploitation, and CISA has not listed CVE-2026-78401 in its Known Exploited Vulnerabilities catalogue. IBM has not published a statement on exploitation.
Who is affected
Affected deployments are:
- IBM Security Verify Access 10.0 through 10.0.9.2
- IBM Verify Identity Access 11.0 through 11.0.3
- Security Verify Access Container 10.0 through 10.0.9.2
- Verify Identity Access Container 11.0 through 11.0.3
These are identity and access management systems that usually handle sign-on and access policy, and are commonly reachable over the network.
What to do now
- Apply IBM's fix. A fix is available from IBM; obtain the remediated release for your version from the IBM support page linked in the references.
- If you cannot patch immediately, restrict network access to the affected appliances and containers. The vulnerability is exploitable remotely and without credentials, so reduce external or untrusted reach to sign-on and administration interfaces.
- After patching, verify that identity services and dependent applications are working, as this is a critical authentication component.
How to detect it
No vendor-published indicators of compromise are listed in the CVE record. Detection should therefore rely on existing endpoint and network monitoring for signs of arbitrary code execution on affected hosts.
Beyond the patch
Because this flaw is reachable over the network without credentials, an exposed Verify Access deployment is a direct exposure-management issue — Virtual CISO Services can help you map and reduce that attack surface. Successful exploitation is arbitrary code execution, which Managed Detection & Response can detect and contain. A penetration test is the right check for deserialisation and authentication flaws like this.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Security Verify Access | 10.0 – ≤ 10.0.9.2 | 10.0.9.3 |
| Verify Identity Access | 11.0 – ≤ 11.0.3 | 11.0.3.1 |
| Security Verify Access Container | 10.0 – ≤ 10.0.9.2 | No fixed version listed yet |
| Verify Identity Access Container | 11.0 – ≤ 11.0.3 | No fixed version listed yet |