{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1342", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-01-22T15:34:08.326Z", "datePublished": "2026-04-07T23:21:17.074Z", "dateUpdated": "2026-04-08T14:24:08.124Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-04-07T23:27:25.108Z"}, "title": "Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-829", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Verify Identity Access Container", "versions": [{"status": "affected", "version": "11.0", "lessThanOrEqual": "11.0.2", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access_container:11.0.2:*:*:*:*:*:*:*"]}, {"vendor": "IBM", "product": "Security Verify Access Container", "versions": [{"status": "affected", "version": "10.0", "lessThanOrEqual": "10.0.9.1", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access_container:10.0.9.1:*:*:*:*:*:*:*"]}, {"vendor": "IBM", "product": "Verify Identity Access", "versions": [{"status": "affected", "version": "11.0", "lessThanOrEqual": "11.0.2", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access:11.0.2:*:*:*:*:*:*:*"]}, {"vendor": "IBM", "product": "Security Verify Access", "versions": [{"status": "affected", "version": "10.0", "lessThanOrEqual": "10.0.9.1", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access:10.0.9.1:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow a locally authenticated user to execute malicious scripts from outside of its control sphere.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow a locally authenticated user to execute malicious scripts from outside of its control sphere.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7268253", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L"}}], "workarounds": [{"lang": "en", "value": "None\n\nNone", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>None</p><p>None</p>"}]}], "solutions": [{"lang": "en", "value": "IBM encourages customers to update their systems promptly.\n\n\u00a0\n\nAppliance:\u00a0\n\nAffected Products and Versions\n\nFix availability\n\nIBM Verify Identity Access 11.0 - 11.0.2\n\n Download IBM Verify Identity Access v11.0.2 IF1 https://www.ibm.com/support/fixcentral/quickorder \n\nIBM Security Verify Access 10.0 - 10.0.9.1\n\n Download IBM Security Verify Access v10.0.9.1 IF1 https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n\u00a0\n\nContainer:\n\n Container Download https://docs.verify.ibm.com/ibm-security-verify-access/docs/containers", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><strong><br>IBM encourages customers to update their systems promptly.</strong></p><p>&nbsp;</p><p><strong>Appliance:&nbsp;</strong></p><div><table><thead><tr><td><p><strong>Affected Products and Versions</strong></p></td><td><p><strong>Fix availability</strong></p></td></tr><tr><td><p>IBM Verify Identity Access 11.0 - 11.0.2</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FIBM+Verify+Identity+Access&amp;fixids=11.0.2.0-ISS-IVIA-IF0001&amp;source=SAR\" rel=\"nofollow\">Download IBM Verify Identity Access v11.0.2 IF1</a></p></td></tr><tr><td><p>IBM Security Verify Access 10.0 - 10.0.9.1</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FIBM+Security+Verify+Access&amp;fixids=10.0.9.1-ISS-ISVA-IF0001&amp;source=SAR\" rel=\"nofollow\">Download IBM Security Verify Access v10.0.9.1 IF1</a></p></td></tr></thead></table></div><p>&nbsp;</p><p><strong>Container:</strong></p><p><a href=\"https://docs.verify.ibm.com/ibm-security-verify-access/docs/containers\" rel=\"nofollow\">Container Download</a></p>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T14:23:55.477694Z", "id": "CVE-2026-1342", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T14:24:08.124Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1342", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T14:23:55.477694Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T14:24:04.709Z"}}], "cna": {"title": "Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access_container:11.0.2:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Verify Identity Access Container", "versions": [{"status": "affected", "version": "11.0", "versionType": "semver", "lessThanOrEqual": "11.0.2"}]}, {"cpes": ["cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access_container:10.0.9.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Security Verify Access Container", "versions": [{"status": "affected", "version": "10.0", "versionType": "semver", "lessThanOrEqual": "10.0.9.1"}]}, {"cpes": ["cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access:11.0.2:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Verify Identity Access", "versions": [{"status": "affected", "version": "11.0", "versionType": "semver", "lessThanOrEqual": "11.0.2"}]}, {"cpes": ["cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access:10.0.9.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Security Verify Access", "versions": [{"status": "affected", "version": "10.0", "versionType": "semver", "lessThanOrEqual": "10.0.9.1"}]}], "solutions": [{"lang": "en", "value": "IBM encourages customers to update their systems promptly.\n\n\u00a0\n\nAppliance:\u00a0\n\nAffected Products and Versions\n\nFix availability\n\nIBM Verify Identity Access 11.0 - 11.0.2\n\n Download IBM Verify Identity Access v11.0.2 IF1 https://www.ibm.com/support/fixcentral/quickorder \n\nIBM Security Verify Access 10.0 - 10.0.9.1\n\n Download IBM Security Verify Access v10.0.9.1 IF1 https://www.ibm.com/support/fixcentral/quickorder \n\n\n\n\u00a0\n\nContainer:\n\n Container Download https://docs.verify.ibm.com/ibm-security-verify-access/docs/containers", "supportingMedia": [{"type": "text/html", "value": "<p><strong><br>IBM encourages customers to update their systems promptly.</strong></p><p>&nbsp;</p><p><strong>Appliance:&nbsp;</strong></p><div><table><thead><tr><td><p><strong>Affected Products and Versions</strong></p></td><td><p><strong>Fix availability</strong></p></td></tr><tr><td><p>IBM Verify Identity Access 11.0 - 11.0.2</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FIBM+Verify+Identity+Access&amp;fixids=11.0.2.0-ISS-IVIA-IF0001&amp;source=SAR\" rel=\"nofollow\">Download IBM Verify Identity Access v11.0.2 IF1</a></p></td></tr><tr><td><p>IBM Security Verify Access 10.0 - 10.0.9.1</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FIBM+Security+Verify+Access&amp;fixids=10.0.9.1-ISS-ISVA-IF0001&amp;source=SAR\" rel=\"nofollow\">Download IBM Security Verify Access v10.0.9.1 IF1</a></p></td></tr></thead></table></div><p>&nbsp;</p><p><strong>Container:</strong></p><p><a href=\"https://docs.verify.ibm.com/ibm-security-verify-access/docs/containers\" rel=\"nofollow\">Container Download</a></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7268253", "tags": ["vendor-advisory", "patch"]}], "workarounds": [{"lang": "en", "value": "None\n\nNone", "supportingMedia": [{"type": "text/html", "value": "<p>None</p><p>None</p>", "base64": false}]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow a locally authenticated user to execute malicious scripts from outside of its control sphere.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow a locally authenticated user to execute malicious scripts from outside of its control sphere.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-04-07T23:27:25.108Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1342", "state": "PUBLISHED", "dateUpdated": "2026-04-08T14:24:08.124Z", "dateReserved": "2026-01-22T15:34:08.326Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-04-07T23:21:17.074Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow a locally authenticated user to execute malicious scripts from outside of its control sphere."}], "id": "CVE-2026-1342", "lastModified": "2026-04-08T21:26:35.910", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.3, "source": "psirt@us.ibm.com", "type": "Primary"}]}, "published": "2026-04-08T00:16:03.860", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7268253"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-829"}], "source": "psirt@us.ibm.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-08T00:21:27.702028+00:00", "value": {"mitigation_remediation": ["Update IBM Verify Identity Access to version 11.0.2 or later", "Update IBM Security Verify Access to version 10.0.9.1 or later", "Apply the corresponding container image updates from IBM\u2019s documentation", "Verify the applied patch by reviewing the release notes or version number"], "summary": {"action": "Patch", "impact": "Unrestricted code execution"}, "threat_synthesis": {"affected_systems": "Affected products include IBM Verify Identity Access and IBM Security Verify Access for both standard and container editions. The vulnerable versions range from 10.0 to 10.0.9.1 for IBM Security Verify Access and from 11.0 to 11.0.2 for IBM Verify Identity Access. Container images for these product lines are also impacted. These include the base product and the corresponding container deployments of both 10.x and 11.x series.", "description_and_impact": "A vulnerability exists in IBM Verify Identity Access and IBM Security Verify Access that allows a user who has already authenticated locally to execute malicious scripts from outside the application\u2019s intended control sphere. This flaw is classified under CWE\u2011829 and could enable an attacker who has gained local access to trigger arbitrary code, potentially compromising the integrity and confidentiality of the system. The nature of the weakness means that unexpected scripts can run with the privileges of the authenticated user, creating a risk of further lateral movement or system takeover.", "risk_and_exploitability": "The CVSS score of 8.5 indicates high severity, and though EPSS data is not available, the lack of a KEV listing suggests this vulnerability has not yet been widely exploited publicly. The attack vector is inferred to be local authentication, meaning the threat primarily belongs to users who can authenticate to the system. An attacker would need to be able to log in or otherwise obtain local credentials before leveraging this flaw, after which malicious scripts could be triggered from outside the normal application boundaries. The combination of a high CVSS score and potential for code execution makes remediation a priority."}}}}, "created": "2026-04-08T19:45:10.329651+00:00", "updated": "2026-04-08T19:45:10.329682+00:00", "vendors": []}