Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
CRITICAL severity

CVE-2026-19491 — Security Verify Access

CRITICAL

CVE-2026-19491 is a critical-severity (CVSS 9.1) Improper Authentication vulnerability in ibm security verify access. No vendor fix is recorded yet; mitigation options are listed below.

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.

Published
Updated
Affected
4 products
Patched
See advisory
Exploits
None indexed
Exploitation data as of Oct 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.

Affected Products

4 products · 12 configurations
Application
security verify accessibm
3 versions
10.010.0.010.0.9.2
Application
security verify access containeribm
3 versions
10.010.0.010.0.9.2
Application
verify identity accessibm
3 versions
11.011.0.011.0.3
Application
verify identity access containeribm
3 versions
11.011.0.011.0.3

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every ibm security verify access deployment and check each version against the affected-products list above.

  2. Remediation status

    No patch has shipped for CVE-2026-19491 yet — track the ibm security verify access advisory for a fixed release and apply the workarounds below in the meantime.

  3. Mitigate without a patch

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

Frequently Asked Questions

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.
O3 Security · Runtime Protection

Is CVE-2026-19491 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works
CVE-2026-19491: Security Verify Access (Critical 9.1)