IBM Security Verify Access Flaw Lets Attackers Skip Login Checks, Exposing Orgs to Unauthorized Remote Access

IBM has disclosed a critical security vulnerability in its enterprise identity management products that allows remote attackers to bypass authentication mechanisms entirely. The flaw, identified as CVE-2026-19491, impacts widely deployed versions of IBM Security Verify Access and IBM Verify Identity Access. For organizations relying on these systems to control user access to sensitive applications, the issue presents an immediate risk of unauthorized entry.

In plain English

Authentication is the process by which a system verifies that a user is who they claim to be, typically through passwords, tokens, or biometrics. When this process fails or is bypassed, attackers can enter protected systems without valid credentials. In this case, the vulnerability allows an attacker to skip the login step altogether. This means that anyone with network access to the vulnerable IBM server could potentially gain entry to resources that should be restricted to authorized personnel only.

The background

The National Vulnerability Database (NVD) records CVE-2026-19491 with a CVSS score of 9.1, placing it in the critical severity range. The underlying weakness is categorized under CWE-287, which refers to improper authentication. This type of flaw occurs when a system does not correctly verify user identities before granting access. The affected software versions include IBM Security Verify Access from version 10.0 through 10.0.9.2, as well as IBM Verify Identity Access from version 11.0 through 11.0.3. Containerized versions of these products are also impacted.

What changes now

Security teams must immediately assess their environments to determine if they are running any of the affected versions. Because the vulnerability allows for remote exploitation, it does not require an attacker to have prior access to the internal network, making it a high-priority threat. Organizations should prioritize identifying instances of IBM Security Verify Access and IBM Verify Identity Access in their infrastructure. Until a patch is available, compensating controls may be necessary to limit exposure.

What to do and how to stay safe: IBM

• Inventory all instances of IBM Security Verify Access and IBM Verify Identity Access to identify if any are running versions 10.0.9.2 or earlier, or 11.0.3 or earlier.
• Monitor network logs for unusual authentication attempts or access patterns that bypass standard login procedures.
• Restrict network access to the affected servers to trusted IP addresses only, reducing the attack surface for remote exploitation.
• Once the vendor provides an update, apply patches immediately to resolve the improper authentication flaw.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which IBM products are affected by CVE-2026-19491?

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3), including their containerized versions, are affected.

How severe is this vulnerability?

The National Vulnerability Database rates CVE-2026-19491 as critical with a CVSS score of 9.1.

What is the root cause of the authentication bypass?

The vulnerability is caused by improper authentication handling, classified as CWE-287, which allows remote attackers to bypass security checks.