Advisory · CVE-2026-16916
Authenticated remote code execution in IBM Security Verify Access
A remote authenticated attacker can execute arbitrary code on IBM Security Verify Access due to a protection mechanism failure.
- Vendor
- IBM
- Product
- Security Verify Access
- Identifier / CWE
- CVE-2026-16916
CWE-693 - Action timing
- Immediate
Explain it like I’m five
A tenant with a valid key discovers a loose panel in the wall of the identity vault and climbs through it into the machinery room.
- 01Authenticated session
An attacker logs in with valid credentials, possibly low-privileged.
- 02Mechanism failure
A protection mechanism that should contain the session fails to do so.
- 03Code execution
The attacker executes arbitrary code on the Verify Access system.
What happened
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure, according to the IBM security bulletin. IBM rates it critical at CVSS 9.1.
What to do
- Inventory Verify Access and Verify Identity Access deployments and confirm versions.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Limit authenticated access to trusted users and review privileged account activity until patched.
- Investigate for unexpected processes or persistence on affected hosts.
Management note
Code execution on the identity provider is game over for every system that trusts it. Patch first, investigate second, rotate third.