IBM Verify Access and Identity versions 10-11 face remote auth bypass with no confirmed patch yet

IBM security products contain a critical vulnerability that allows remote attackers to bypass authentication controls. The flaw, tracked as CVE-2026-16823, affects multiple versions of IBM Security Verify Access and IBM Verify Identity Access. According to the National Vulnerability Database, the issue stems from improper authentication mechanisms that fail to enforce security restrictions.

In plain English

Authentication is the process of verifying who you are, like showing an ID badge to enter a building. When this process fails, it is called an authentication bypass. In this case, the software does not properly check credentials before granting access. This means an attacker does not need a valid password or token to get in. They can simply send a request that the system accepts without proper verification.

The weakness is classified as CWE-287, which stands for improper authentication. This is a fundamental security failure because it undermines the primary gatekeeper of the system. An attacker can connect remotely and access resources that should be protected. This is not a minor glitch; it is a complete breakdown of the login process. The system trusts the attacker without proof of identity.

The background

The vulnerability exists in specific version ranges of IBM’s identity management tools. IBM Security Verify Access versions 10.0 through 10.0.9.2 are affected. This includes the standard installation and the container version up to 10.0.9.2. Similarly, IBM Verify Identity Access versions 11.0 through 11.0.3 are vulnerable. The container version of this product up to 11.0.3 is also at risk.

The National Vulnerability Database rates this issue as Critical with a CVSS score of 9.1. This high score reflects the ease with which an attacker can exploit the flaw and the severe impact on confidentiality, integrity, and availability. The flaw allows remote exploitation, meaning the attacker does not need physical access to the server. They can trigger the bypass from anywhere on the internet if the service is exposed.

What changes now

Organizations using these IBM products must assess their exposure immediately. Since no patch has been confirmed yet, there is no software update to install. Security teams need to determine if their instances are reachable from untrusted networks. If the affected versions are in use, the risk is immediate and severe. Administrators should review access logs for signs of unauthorized entry. The lack of a fix means mitigation relies on network controls and monitoring until IBM releases an update.

What to do and how to stay safe: IBM

• Check your environment for IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3.
• Restrict network access to these services so they are not directly reachable from the internet.
• Monitor authentication logs for unusual patterns that indicate bypass attempts.
• Prepare to apply an update once the vendor provides a confirmed fix for CVE-2026-16823.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-16823?

It is a critical vulnerability in IBM identity products that allows remote attackers to bypass authentication.

Which IBM products are affected?

IBM Security Verify Access up to 10.0.9.2 and IBM Verify Identity Access up to 11.0.3, including their container versions.

Is there a patch available?

No fix has been confirmed yet.