Advisory · CVE-2026-19494
Authenticated security-restriction bypass in IBM Security Verify Access
A remote authenticated attacker can bypass security restrictions in IBM Security Verify Access due to improper authentication.
- Vendor
- IBM
- Product
- Security Verify Access
- Identifier / CWE
- CVE-2026-19494
CWE-287 - Action timing
- Immediate
Explain it like I’m five
An employee badge opens the lobby, but a loose wiring lets it also open the server room. The badge was real; the access was not supposed to be.
- 01Authenticated session
An attacker holds valid but limited credentials.
- 02Restriction bypass
Improper authentication handling lets the session cross a restriction boundary.
- 03Elevated reach
The attacker performs actions reserved for higher-privileged identities.
What happened
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication, according to the IBM security bulletin. IBM rates it high at CVSS 8.1.
What to do
- Inventory Verify Access and Verify Identity Access deployments and confirm versions.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Review authorization decisions and privileged actions taken by authenticated users until patched.
Management note
This is the authenticated sibling of the two unauthenticated bypasses in the same bulletin. Together they argue for a full re-review of Verify Access authorization logic, not just a patch.