Authenticated Hackers Can Execute Code Via Critical Flaw in IBM Security Verify Products
A critical vulnerability in IBM identity products allows authenticated attackers to run arbitrary code on affected systems.
Key points
- IBM Security Verify Access and Verify Identity Access contain a CVSS 9.1 critical flaw.
- The vulnerability enables remote authenticated attackers to execute arbitrary code.
- Versions up to 10.0.9.2 and 11.0.3 are affected, including containerized deployments.
IBM has disclosed a severe security flaw in its identity management suite, specifically impacting Security Verify Access and Verify Identity Access. The vulnerability, tracked as CVE-2026-16916, carries a CVSS score of 9.1, classifying it as critical. This issue allows a remote attacker who has already authenticated to the system to execute arbitrary code on the host.
In plain English
This flaw represents a significant breach of trust within the system’s internal protections. While an attacker must first log in with valid credentials, once inside, they can bypass standard safety mechanisms. This failure allows them to run any command or software they choose on the server. For organizations, this means that a compromised user account—whether stolen or hijacked—could lead to total system takeover, not just data access.
The background
The issue stems from a protection mechanism failure, categorized under CWE-693. It affects multiple deployment models of IBM’s identity products. Specifically, IBM Security Verify Access versions 10.0 through 10.0.9.2 are vulnerable. Similarly, IBM Verify Identity Access versions 11.0 through 11.0.3 are at risk. The vulnerability also extends to containerized versions of these products, meaning organizations running these tools in Kubernetes or other container environments are equally exposed.
What changes now
Organizations using these specific versions of IBM’s identity tools face immediate risk. Because the flaw allows for arbitrary code execution, the potential impact is high, ranging from data theft to full infrastructure control. Security teams must verify their current versions against the affected ranges. Since the National Vulnerability Database records the flaw as critical, it demands urgent attention from IT leadership. There is no indication in the source material that a patch has been released or confirmed as available yet.
What to do and how to stay safe: IBM
- Inventory all instances of IBM Security Verify Access and Verify Identity Access to identify affected versions.
- Restrict access to administrative interfaces and enforce strict multi-factor authentication to raise the barrier for attackers.
- Monitor logs for unusual command executions or privilege escalation attempts from authenticated users.
- Isolate vulnerable systems from critical network segments until a vendor update is provided.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-16916?
It is a critical vulnerability in IBM Security Verify Access and Verify Identity Access that allows remote authenticated attackers to execute arbitrary code.
Which IBM products are affected?
IBM Security Verify Access up to version 10.0.9.2 and IBM Verify Identity Access up to version 11.0.3, including their container versions.
Is there a fix available?
No fix has been confirmed yet in the provided source material.
