Advisory · CVE-2026-78401
Unauthenticated deserialization RCE in IBM Security Verify Access
IBM Security Verify Access deserializes untrusted data, letting a remote unauthenticated attacker execute arbitrary code on the system.
- Vendor
- IBM
- Product
- Security Verify Access
- Identifier / CWE
- CVE-2026-78401
CWE-502 - Action timing
- Immediate
Explain it like I’m five
The vault accepts sealed parcels and opens them without checking what is inside. An attacker mails a parcel that unpacks itself into a working lockpick.
- 01Serialized payload
A remote unauthenticated attacker crafts a malicious serialized object.
- 02Deserialization
Verify Access deserializes the untrusted data into live objects.
- 03Code execution
The payload executes arbitrary code on the system with the service's privileges.
What happened
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data, according to the IBM security bulletin. IBM rates it critical at CVSS 9.8.
Unauthenticated deserialization leading to remote code execution on the identity provider is the worst shape this bulletin has to offer, and the bulletin has plenty of shapes.
What to do
- Inventory Verify Access and Verify Identity Access deployments and confirm versions.
- Apply the remediation from the IBM security bulletin immediately.
- Isolate affected systems from untrusted networks until patched.
- Hunt for signs of exploitation: unexpected processes, new accounts, persistence mechanisms, and anomalous outbound traffic.
Management note
If this system was reachable from untrusted networks, assume compromise is possible and investigate accordingly. The identity tier does not get the benefit of the doubt.