CVE-2026-4938
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
IBM Verify Identity Access and IBM Security Verify Access in the specified versions could allow an attacker with read-only privileges to make unauthorized modifications and deployments outside of their assigned permissions.
Risk Assessment
The risk is that a user with limited privileges can escalate their rights and perform unauthorized changes to the system configuration, potentially leading to integrity and security breaches.
Recommendation
It is recommended to immediately apply the latest security patches provided by IBM and review and restrict read-only user permissions.
Other vulnerabilities in IBM Verify Identity Access
See all- CVE-2026-11904Medium
IBM Verify Identity Access and Security Verify Access products may return detailed technical error messages in the browser, allowing a remote attacker to obtain sensitive information.
- CVE-2026-7364Low
IBM Verify Identity Access and IBM Security Verify Access contain an open redirect vulnerability that allows a remote attacker to conduct phishing attacks by using a specially crafted request to redirect a victim to arbitrary websites.
Original NVD description (English source)
IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow an attacker with read-only privileges to make unauthorized modifications and deployments outside of their assigned permissions.