IBM Verify Identity Access deserialization allows unauthenticated remote code execution (CVE-2026-78406)

What happened

A weakness in deserialisation of untrusted data allows a remote attacker to execute arbitrary code on the affected system over the network, without authentication and without any user action. This is a critical condition, rated CVSS 9.8, with high impact to confidentiality, integrity and availability.

No public disclosure or CISA KEV listing is recorded for this CVE in the available sources. IBM has published advisory details and states that a fix is available.

Who is affected

IBM Security Verify Access 10.0 through 10.0.9.2 IBM Verify Identity Access 11.0 through 11.0.3 IBM Security Verify Access Container 10.0 through 10.0.9.2 IBM Verify Identity Access Container 11.0 through 11.0.3

These products typically act as identity and access management gateways that enforce authentication and authorisation; they are often reachable from enterprise, partner or customer networks.

What to do now

1. Apply IBM's fix. Confirm the exact fixed release for your version from the IBM advisory and test in a non-production environment before deployment.
2. If you cannot patch immediately, restrict network reach to the Verify Identity Access and Security Verify Access hosts and administration interfaces, allowing only trusted networks.
3. Review any exposure of these systems from the internet or partner networks. Because the flaw requires no credentials, reachable instances should be patched or isolated first.
4. After applying the fix, verify the update and monitor the hosts.

How to detect it

The CVE record and IBM advisory do not list specific indicators of compromise. Treat the affected hosts as the detection boundary: successful use of this flaw is remote code execution, so EDR or SIEM monitoring should be checked for unexpected process creation, unusual outbound connections, or other signs of execution on Identity Access systems.

Beyond the patch

This is a pre-authentication, network-reachable flaw in an identity gateway, so exposure management matters before an advisory forces a patch sprint, and post-exploitation detection matters after. Virtual CISO Services (vCISO) helps you find and reduce exposed services and open ports, while Managed Detection & Response (MDR) provides EDR and SIEM monitoring that catches the activity this kind of arbitrary code execution can produce. Apply the patch first; then use these to reduce the next one.