Advisory · CVE-2026-78406
Unauthenticated deserialization RCE in IBM Security Verify Access
A second deserialization flaw in IBM Security Verify Access lets a remote unauthenticated attacker execute arbitrary code on the system.
- Vendor
- IBM
- Product
- Security Verify Access
- Identifier / CWE
- CVE-2026-78406
CWE-502 - Action timing
- Immediate
Explain it like I’m five
A second parcel slot on the same vault, same problem: it opens whatever arrives and trusts whatever comes out.
- 01Serialized payload
A remote unauthenticated attacker crafts a malicious serialized object for this vector.
- 02Deserialization
Verify Access deserializes the untrusted data into live objects.
- 03Code execution
The payload executes arbitrary code on the system with the service's privileges.
What happened
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data, according to the IBM security bulletin. IBM rates it critical at CVSS 9.8. It is the second unauthenticated deserialization RCE in the same bulletin, so one patch will not be a full fix for the class.
What to do
- Inventory Verify Access and Verify Identity Access deployments and confirm versions.
- Apply the remediation from the IBM security bulletin immediately, covering both deserialization vectors.
- Isolate affected systems from untrusted networks until patched.
- Hunt for signs of exploitation: unexpected processes, new accounts, persistence mechanisms, and anomalous outbound traffic.
Management note
Two 9.8 deserialization RCEs in the identity tier, plus two auth bypasses, plus command injection, in one bulletin. This is a rebuild-the-patch-plan week for Verify Access shops.