IBM Identity Access Software Has Critical Deserialization Flaw Allowing Remote Code Execution

IBM’s identity management software contains a severe security gap that allows remote attackers to execute code on affected systems without needing credentials. The National Vulnerability Database (NVD) has assigned the issue CVE-2026-78406 and rated it Critical with a CVSS score of 9.8. This means the flaw is easily exploitable and could give an attacker full control over the compromised server.

In plain English

The vulnerability exists in how the software processes data sent to it. Specifically, the application deserializes untrusted data. Deserialization is the process of converting a stream of data back into an object that the program can use. When this process handles data that has not been properly verified or sanitized, an attacker can craft a malicious data stream. When the software reads this stream, it executes the code hidden inside it.

Because the attack requires no authentication, an attacker does not need to steal a password or bypass a login screen. They simply need network access to the service listening on the vulnerable port. Once the malicious code runs, the attacker can perform any action the application is permitted to do, which often includes reading sensitive files, installing additional malware, or creating backdoors for future access.

The background

The flaw impacts two main product lines: IBM Security Verify Access and IBM Verify Identity Access. For the Security Verify Access line, any version from 10.0 up to and including 10.0.9.2 is affected. This also includes the containerized version of the software, IBM Security Verify Access Container, up to version 10.0.9.2.

Similarly, IBM Verify Identity Access is vulnerable in versions 11.0 through 11.0.3. The container variant, IBM Verify Identity Access Container, shares the same vulnerability range up to 11.0.3. The underlying weakness is categorized as CWE-502, which refers to the improper deserialization of untrusted data. This is a common class of vulnerability in enterprise software, often discovered during routine security audits or by researchers analyzing application logic.

What changes now

Security operations teams must immediately identify if their environments are running these specific versions. The high severity score indicates that exploitation is technically straightforward and the impact is severe. Organizations relying on these versions for access control or identity verification are exposed to direct remote compromise. Until a vendor update is available, the primary mitigation involves reducing the attack surface by restricting network access to the vulnerable services.

What to do and how to stay safe: IBM

• Inventory all servers running IBM Security Verify Access or IBM Verify Identity Access to determine if they fall within the affected version ranges.
• Restrict network access to these services so that only trusted internal hosts can communicate with them, blocking external exposure.
• Monitor logs for unusual deserialization errors or unexpected outbound connections from the application servers.
• Check vendor communications daily for the release of a patch or workaround, and plan an immediate update once it is confirmed.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific IBM products are affected by CVE-2026-78406?

IBM Security Verify Access (10.0-10.0.9.2), IBM Security Verify Access Container (10.0-10.0.9.2), IBM Verify Identity Access (11.0-11.0.3), and IBM Verify Identity Access Container (11.0-11.0.3).

Is authentication required to exploit this vulnerability?

No, the NVD description states that a remote unauthenticated attacker can exploit the flaw to execute arbitrary code.

What is the severity rating for this CVE?

The National Vulnerability Database rates CVE-2026-78406 as Critical with a CVSS score of 9.8.