CVE-2026-1342

CVE-2026-1342 is a privilege escalation vulnerability affecting IBM Verify Identity Access and IBM Security Verify Access products, specifically versions 11.0 through 11.0.2 and 10.0 through 10.0.9.1 in both container and standard deployments. The flaw allows a locally authenticated user to execute arbitrary malicious scripts outside of the application's intended control sphere, potentially compromising system integrity and confidentiality. The vulnerability carries a HIGH CVSS score of 8.5, with a local attack vector, low complexity, and no special privileges required for exploitation. The attack has significant impact across confidentiality (high), integrity (low), and availability (low) with changed scope, indicating potential for system-wide compromise beyond the vulnerable component itself. Currently, there is no evidence of active exploitation in the wild, with the EPSS score of 0.00015 suggesting minimal real-world exploitation probability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on vulnerability hot lists, though organizations running the affected versions should prioritize patching given the moderate FAUCET risk score of 51.0 and the local authentication requirement that limits exposure.