Advisory · CVE-2026-18740
Authenticated argument injection in IBM Security Verify Access
A remote authenticated attacker can inject arguments in IBM Security Verify Access to perform unauthorized actions.
- Vendor
- IBM
- Product
- Security Verify Access
- Identifier / CWE
- CVE-2026-18740
CWE-88 - Action timing
- Immediate
Explain it like I’m five
A tenant is allowed to order room service by writing items on a form. The form goes straight to the kitchen, so writing extra items gets the kitchen to do things room service was never supposed to do.
- 01Authenticated request
An attacker with valid credentials submits a request carrying crafted arguments.
- 02Neutralization failure
The arguments are passed to an underlying command without safe handling.
- 03Unauthorized actions
The attacker performs actions beyond their intended privileges.
What happened
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to argument injection, according to the IBM security bulletin. A remote authenticated attacker can perform unauthorized actions due to improper neutralization of command arguments. IBM rates it high at CVSS 8.8.
What to do
- Inventory Verify Access and Verify Identity Access deployments and confirm versions.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Review activity of authenticated users for actions outside their normal scope until patched.
Management note
Authenticated injection flaws raise the stakes on every service account and delegated admin in the environment. Least privilege is the mitigation that matters while you wait for the patch.