CVE-2026-5926

OVERVIEW CVE-2026-5926 affects IBM Verify Identity Access Container versions 11.0 through 11.0.2 and 10.0 through 10.0.9.1, as well as the non-containerized IBM Security Verify Access products in the same version ranges. The vulnerability stems from the use of weaker than expected cryptographic algorithms, which could enable attackers to decrypt highly sensitive information protected by these systems. SEVERITY The vulnerability carries a CVSS 3.1 score of 6.5 (Medium) with a network-based attack vector requiring low complexity and low privileges. The attack requires an authenticated user (PR:L) with no user interaction needed, resulting in high confidentiality impact but no integrity or availability compromise. The FAUCET risk score of 35.0 out of 100 indicates moderate concern within the broader vulnerability landscape. EXPLOITATION STATUS This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no confirmed active exploitation. The EPSS score of 0.00028 indicates the probability of exploitation is significantly lower than the average CVE, and the vulnerability's absence from active hot lists further suggests minimal community attention or publicly available exploit code at this time.