CVE-2026-109126: IBM Verify Identity Access and Security Verify Access hard-coded credentials privilege escalation

CVE-2026-109126 · Severity: high · CVSS 8.8 · Published 2026-10-20

IBM Verify Identity Access and IBM Security Verify Access are identity and access management appliances used to control authentication and authorization across enterprise networks. These appliances contain hard-coded credentials that allow a physically proximate attacker to gain elevated privileges without authentication, potentially leading to complete compromise of access controls. An attacker with physical access could use these credentials to take control of the appliance and bypass security policies across an entire organization.

Technologies: IBM Security Verify Access, IBM Verify Identity Access. Vendors: IBM.

Quick answers

Is CVE-2026-109126 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109126 being exploited in the wild.
How severe is CVE-2026-109126?
High severity, with a CVSS score of 8.8, published 20 October 2026.
Which products and versions are affected?
IBM Security Verify Access 10.0.9.3; IBM Verify Identity Access 11.0.3.1.
Is there a fix for CVE-2026-109126?
Yes: fixed in IBM Verify Identity Access 11.0.3.2; IBM Security Verify Access 10.0.9.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109126 attacked?
It is attacked with physical access, in a network appliance.
Am I affected by CVE-2026-109126?
Check whether you run IBM Security Verify Access or IBM Verify Identity Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: IBM Verify Identity Access 11.0.3.2; IBM Security Verify Access 10.0.9.4

Technical details

The vulnerability stems from hard-coded credentials embedded in the appliance firmware (CWE-798). An attacker with physical proximity to the appliance can use these credentials to authenticate and escalate privileges to administrative level. The attack requires physical access but no authentication or user interaction, resulting in high confidentiality, integrity, and availability impact across the access management infrastructure.

Affected products

  • IBM Verify Identity Access 11.0.3.1
  • IBM Security Verify Access 10.0.9.3

Timeline

  • 2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.