[ CVE-2026-78407 · Published 8 Oct 2026 ]

Vulnerability in IBM Security Verify Access

CVSS 5.4 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund7 Oct 2026WID-SEC-2026-3813

IBM Security Verify Access: Multiple vulnerabilities Translated from German
CVE-2026-16830CVE-2026-19493CVE-2026-78407+19 more CVEs

[ References ]References

www.ibm.com/support/pages/node/7291628Vendor Advisory

[ Facts ]Key facts

CVE: CVE-2026-78407
EUVD: EUVD-2026-95264
Published: 8 Oct 2026, 21:18 UTC
Updated: 9 Oct 2026, 18:17 UTC
NVD status: Modified
CVSS 3.1: 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Scored by psirt@us.ibm.com
EPSS: 0.14% chance of exploitation in 30 days · higher than 3% of CVEs
CISA SSVC: Exploitation: none · Automatable: no · Impact: partial
Weakness: CWE-79

[ Affected ]Affected products

IBM Security Verify Access10.0 – ≤ 10.0.9.2
IBM Verify Identity Access11.0 – ≤ 11.0.3
IBM Security Verify Access Container10.0 – ≤ 10.0.9.2
IBM Verify Identity Access Container11.0 – ≤ 11.0.3

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

IBM Security Verify Access: Multiple vulnerabilities Translated from German

[ References ]References