High priorityDisclosed

Advisory · CVE-2026-8639

IBM Verify Directory session fixation can hijack the directory console

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation, where an attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console, rated high at CVSS 8.8.

Advisory published November 8, 2026Independent summary
Vendor
IBM
Product
Security Verify Directory
Identifier / CWE
CVE-2026-8639
CWE-384
Action timing
Immediate
ELI5

Explain it like I’m five

Verify Directory hands out session IDs before login, and it does not always replace them after. An attacker can plant their own session ID on a victim, wait for the victim to log in, and then use that same session to walk into the directory console as them.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Session established

    An attacker establishes a session with the directory console.

  2. 02Session ID planted

    The attacker gets the victim to use that session.

  3. 03Victim authenticates

    The victim logs in, and the session becomes authenticated.

  4. 04Session hijacked

    The attacker uses the same session to gain unauthorized access to the console.

What happened

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console. The record rates it high at CVSS 8.8 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.

IBM’s bulletin lists the affected versions and the fix. The directory console controls identities, so a hijacked session there is an identity takeover.

What to do

  1. Inventory Verify Directory deployments and record each version.
  2. Check the IBM bulletin for the fix and apply it.
  3. Review console sessions for fixation indicators.
  4. Invalidate sessions established before the fix where possible.
  5. Verify the deployed version after updating.

Management note

Session fixation in the identity directory is an identity takeover with extra steps. Invalidate the old sessions, then patch.