Quick answers
- Is CVE-2026-12101 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12101 being exploited in the wild.
- How severe is CVE-2026-12101?
- High severity, with a CVSS score of 8.1, published 15 September 2026.
- Which products and versions are affected?
- IBM Verify Identity Access.
- Is there a fix for CVE-2026-12101?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-12101 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-12101?
- Check whether you run IBM Verify Identity Access. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an improper authorization vulnerability (CWE-285) in IBM Verify Identity Access caused by insufficient validation of user-supplied input during command execution. The vulnerability requires high-level privileges (administrator role) to exploit and is reachable over the network without user interaction. A malicious administrator can bypass command authorization checks to execute operations they are not entitled to perform, potentially gaining unauthorized access to system functionality and data. Patches addressing this issue have been made available by IBM.
Affected products
- IBM Verify Identity Access
Timeline
- 2026-09-15: disclosed