IBM Security Verify Access, week 41 2026: unauthenticated RCE and auth bypass lead 22 fixes

The release at a glance

IBM published its week 41 security update on 8 October 2026. The release contains 22 CVEs, all affecting IBM Security Verify Access, IBM Verify Identity Access and their container editions. Severity breaks down as 5 critical, 5 high, 10 medium and 2 low. The affected versions are IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3; the container editions, Security Verify Access Container and Verify Identity Access Container, are also affected. IBM has released fixed versions 10.0.9.3 and 11.0.3.1.

None of the 22 CVEs is listed in CISA KEV, and none is marked as exploited. The most urgent issues are unauthenticated remote code execution through untrusted deserialisation and authentication bypass in a network-facing access management product. This is not a routine release for organisations that expose these services, but there is no CISA KEV due date and no indication of active exploitation. IBM's support page has the consolidated advisory.

What matters most

All of the items below are in IBM Security Verify Access. For these entries, IBM Verify Identity Access and the container editions are also affected.

• CVE-2026-78406 and CVE-2026-78401 — critical deserialisation flaws (CVSS 9.8) that allow an unauthenticated remote attacker to execute arbitrary code. These are the first to address and are covered in separate advisories on this site.
• CVE-2026-19491 and CVE-2026-16823 — critical authentication bypasses (CVSS 9.1) that allow a remote unauthenticated attacker to bypass security restrictions. Both have separate advisory pages.
• CVE-2026-16916 — critical protection mechanism failure (CVSS 9.1) that allows a remote authenticated attacker with high privileges to execute arbitrary code. Covered in a separate advisory.
• CVE-2026-19493 — high path traversal (CVSS 7.5) that allows an unauthenticated attacker to write arbitrary files.
• CVE-2026-19482 and CVE-2026-18740 — high-severity command and argument injection flaws (CVSS 8.8) that require a low-privileged authenticated attacker.

Other CVEs in the release include cross-site scripting, denial of service, further authentication workflow limitations and similar issues.

Patch in this order

Patch the network-facing access management tier first.

1. Update IBM Security Verify Access to 10.0.9.3 and IBM Verify Identity Access to 11.0.3.1. These fixed versions are the remediation path for the critical and high-severity items listed above.
2. Start with internet-facing deployments. Apply the fix to the unauthenticated critical flaws first: CVE-2026-78406, CVE-2026-78401, CVE-2026-19491 and CVE-2026-16823.
3. Next, address the authenticated critical and high-severity flaws: CVE-2026-16916, CVE-2026-19482, CVE-2026-18740 and CVE-2026-19493.
4. Apply the same update to IBM Security Verify Access Container and IBM Verify Identity Access Container environments, then address the remaining CVEs in the release.

No CISA KEV due date applies because no CVE in this release is listed in KEV.

Beyond the patch

This release is a reminder to treat identity and access management as part of the external attack surface, not as an internal utility. Virtual CISO Services can help keep network-reachable Verify Access services and open ports in view, and Implementation & Assessment Services can test for the deserialisation, injection and authentication flaws that dominate this update before your next audit or change window.