CVE-2026-12004

Summary

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request.

Affected Software

VendorProductVersion RangeStatus
IBMSecurity Verify Access10.0 <= 10.0.9.2affected
IBMVerify Identity Access11.0 <= 11.0.3affected
IBMVerify Identity Access Container11.0 <= 11.0.3affected
IBMSecurity Verify Access Container10.0 <= 10.0.9.2affected

Weaknesses

  • CWE-134: CWE-134 Use of Externally-Controlled Format String

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References