CVE-2026-12109

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attacker with administrative privileges and access to the local management interface to execute arbitrary code due to an unbounded write to a fixed-size stack buffer.

CVSS 3.1

7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-25)

CWE

CWE-787

Published

2026-10-08

Modified

2026-10-10

Record from

the NVD, synced 2026-10-19

Affected

• ibm:security_verify_access
• ibm:security_verify_access_container
• ibm:verify_identity_access
• ibm:verify_identity_access_container

References

• https://www.ibm.com/support/pages/node/7291628

Check your stackJSON