IBM Identity and Verify Access Vulnerabilities Allow Remote Attacker to Access Sensitive Data

A security advisory reports multiple critical and high-severity vulnerabilities in IBM Verify Identity Access and IBM Security Verify Access (versions 10.0 through 11.0.2 and container deployments), including privilege escalation (CVE-2026-1346, CVSS 9.3), request smuggling (CVE-2026-2862/CVE-2026-1491), SSRF, XSS, OS command injection, memory overflow and authentication bypasses; IBM urges immediate installation of published fixes and updated container images to mitigate potential data exposure, code execution, privilege escalation, or denial-of-service.