Heap-based Out-of-Bounds Read in IBM Security Verify Access and IBM Verify Identity Access
CVE-2026-12091

3.7LOW

Key Information:

Vendor

IBM
Status
Security Verify Access
Verify Identity Access
Security Verify Access Container
Verify Identity Access Container
Vendor
CVE Published:
8 October 2026

What is CVE-2026-12091?

A vulnerability exists in IBM Security Verify Access and IBM Verify Identity Access that allows a remote attacker to exploit a heap-based out-of-bounds read. By sending specially crafted requests, the attacker can trigger limited out-of-bounds memory reads. This could lead to a denial of service, impacting the availability of the affected services. Users of these products are advised to apply patches to mitigate this vulnerability.

Affected Version(s)

Security Verify Access 10.0 <= 10.0.9.2

Security Verify Access Container 10.0 <= 10.0.9.2

Verify Identity Access 11.0 <= 11.0.3

References

https://www.ibm.com/support/pages/node/7291628
vendor-advisorypatch

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.