Sicherheitslücken wurden in IBM Verify Identity Access und IBM Security Verify Access gefunden

Successful exploitation of CVE-2026-1346 grants an attacker root access to the affected system. This allows them to perform any action, including installing malware, accessing sensitive data, modifying system configurations, and potentially compromising other systems on the network. The blast radius is significant, as a compromised root account can be used to gain control of the entire infrastructure. This vulnerability is particularly concerning in environments where IBM Verify Identity Access is used for critical authentication and authorization services, as a successful attack could lead to widespread data breaches and service disruptions. The potential for lateral movement is high, as a root account can be used to pivot to other systems within the network.

Organizations utilizing IBM Verify Identity Access in environments with local user authentication are at risk. This includes deployments with legacy configurations, shared hosting environments where multiple users have local access, and those relying on default or poorly configured access controls. Specifically, environments where local accounts have unnecessary privileges are particularly vulnerable.

• ibm / server:

# Check for vulnerable versions
grep -r '10.0\|11.0' /opt/IBM/VerifyIdentityAccess/bin/version.sh

• linux / server:

# Audit user privileges and processes running with elevated permissions
sudo -u root ps aux | grep -i 'verifyidentityaccess'

1. 2026-04-08Disclosure

   disclosure

1. Reserviert2026-01-22
2. Veröffentlicht2026-04-08
3. Geändert2026-04-09
4. EPSS aktualisiert2026-04-15

The primary mitigation is to upgrade IBM Verify Identity Access to a patched version. Consult IBM's security advisory for the specific fixed version. If immediate upgrade is not possible, consider implementing stricter access controls to limit the privileges of locally authenticated users. Review and restrict the permissions granted to the application user. Implement intrusion detection and prevention systems (IDS/IPS) to monitor for suspicious activity related to privilege escalation attempts. After upgrading, verify the fix by attempting to execute commands with a low-privileged user account and confirming that they are denied the necessary permissions.