CVE-2026-4101 is an authentication bypass vulnerability affecting IBM Verify Identity Access and IBM Security Verify Access, including their containerized versions 10.0 through 10.0.9.1 and 11.0 through 11.0.2. Rated with a CVSS score of 8.1 (High), this flaw allows an unauthenticated attacker to gain unauthorized access to the application under certain load conditions, leading to high impacts on confidentiality, integrity, and availability. The attack complexity is high, requiring specific environmental factors to exploit. Currently, there is no evidence of active exploitation, nor are public exploit codes available in common databases like Metasploit or ExploitDB. Its EPSS score of 0.00085 indicates a very low probability of exploitation in the wild, with minimal community discussion observed.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 10.0.0.0, <= 10.0.9.1CPE matchmatch criteria | cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:* | ||
>= 10.0.0.0, <= 10.0.9.1CPE matchmatch criteria | cpe:2.3:a:ibm:security_verify_access_container:*:*:*:*:*:*:*:* | ||
>= 11.0.0.0, <= 11.0.2.0CPE matchmatch criteria | cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:* | ||
>= 11.0.0.0, <= 11.0.2.0CPE matchmatch criteria | cpe:2.3:a:ibm:verify_identity_access_container:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.