Advisory · CVE-2026-109126
IBM Verify Identity Access hard-coded credentials can give a nearby attacker elevated privileges
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials. CVSS 3.1 8.8.
- Vendor
- IBM
- Product
- IBM Verify Identity Access
- Identifier / CWE
- CVE-2026-109126
CWE-798 - Action timing
- Immediate
Explain it like I’m five
The appliance ships with credentials baked in, so an attacker who can reach it on the nearby network can use those known credentials to gain elevated privileges on the identity system itself.
- 01Appliance reached
An attacker on an adjacent network reaches a Verify Identity Access or Security Verify Access appliance.
- 02Hard-coded credentials used
The attacker uses the hard-coded credentials present in the affected release (CWE-798).
- 03Privileges elevated
Per IBM, the attacker can gain elevated privileges on the appliance.
What happened
IBM PSIRT disclosed CVE-2026-109126: IBM Verify Identity Access and IBM Security Verify Access Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials (CWE-798). The CVSS 3.1 score is 8.8, with adjacent network access required and no privileges or user interaction needed.
Per the vendor affected data in the NVD record, affected releases are IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance. No fixed version is stated in the NVD record itself; IBM’s bulletin is the reference for the fix.
What to do
- Inventory IBM Verify Identity Access and IBM Security Verify Access appliances and note the version of each.
- Apply the fix for your release line from IBM security bulletin 7292606; the NVD record lists the affected releases, so confirm your line against the bulletin rather than assuming a fixed version.
- Restrict appliance management and adjacent network access to trusted networks and named administrators while remediation is underway, and rotate appliance credentials where the bulletin directs it.
- Hunt for logins with default or unexpected credentials, configuration changes by unfamiliar accounts, and access from unexpected adjacent networks.
- Verify the deployed fix level after updating, not just that an update ran.
Management note
This is the identity layer itself. Hard-coded credentials on an access appliance undermine every control behind it, so restrict its network reachability today and patch and rotate on the urgent ring.