Advisory · CVE-2026-19482
Authenticated command injection in IBM Security Verify Access
A remote authenticated attacker can execute arbitrary commands on IBM Security Verify Access through improper neutralization of command arguments.
- Vendor
- IBM
- Product
- Security Verify Access
- Identifier / CWE
- CVE-2026-19482
CWE-88 - Action timing
- Immediate
Explain it like I’m five
The room-service form from the last advisory, except this time the extra items are whole new recipes, and the kitchen cooks them without asking.
- 01Authenticated request
An attacker with valid credentials submits input carrying command arguments.
- 02Neutralization failure
The arguments reach the operating system command without safe quoting.
- 03Command execution
The attacker executes arbitrary commands on the Verify Access host.
What happened
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments, according to the IBM security bulletin. IBM rates it high at CVSS 8.8.
What to do
- Inventory Verify Access and Verify Identity Access deployments and confirm versions.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Review authenticated user and service-account activity for unexpected command execution until patched.
- Investigate affected hosts for persistence.
Management note
Command execution on the identity host is one privilege boundary away from owning the directory. Audit who holds authenticated access to Verify Access while you patch.