Key points
- IBM Verify Identity Access 11.0.3.1 is affected by the vulnerability.
- IBM Security Verify Access 10.0.9.3 is also impacted by the issue.
- The flaw carries a CVSS score of 8.8, rated as high severity.
IBM has disclosed a security issue in its identity management appliances that allows physically present attackers to elevate their privileges. The flaw exists in IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3. According to the National Vulnerability Database, the root cause is the use of hard-coded credentials. This weakness is classified under CWE-798.
In plain English
The vulnerability involves the use of hard-coded credentials within the software. An attacker does not need network access to exploit this flaw. Instead, they must be physically near the appliance hosting the software. Once close enough, the attacker can potentially gain higher-level permissions on the system. This bypasses standard authentication controls.
The background
The National Vulnerability Database assigned CVE-2026-109126 to this issue. It rates the threat at 8.8 on the CVSS scale, which falls into the high severity category. This scoring reflects the significant impact of privilege escalation on system integrity. The weakness affects only the specific appliance versions mentioned. Other versions of IBM Verify Identity or Security Verify Access are not listed as affected in this record.
What changes now
Security teams must identify any instances of IBM Verify Identity Access 11.0.3.1 or IBM Security Verify Access 10.0.9.3 in their environment. Because the credentials are hard-coded, the vulnerability persists in these specific versions. Organizations should audit their physical security controls immediately.
Who needs to act first
Teams usually prioritize systems with direct physical access risks first. Check whether these appliances reside in secure data centers or less protected offices. If the hardware is in a shared or public space, restrict physical access immediately. Back up all configuration data before attempting any changes. Test any future vendor updates in an isolated environment to ensure they resolve the hardcoded credential issue without breaking existing identity workflows.
Background: Privilege escalation attacks
Monitor for unexpected process spawning from low-privilege contexts, changes to system binaries, and abnormal access to sensitive configuration files. Correlate these signals with user behavior baselines to catch lateral movement before it becomes a full compromise.
Read the full guide: Detect Privilege Escalation Attacks: Log Signals and Blind Spots
What to do and how to stay safe: IBM
- Audit physical access logs for servers running IBM Verify Identity Access 11.0.3.1.
- Restrict entry to data centers hosting IBM Security Verify Access 10.0.9.3 appliances.
- Monitor system logs for unexpected privilege escalation attempts from local accounts.
- Contact IBM support to inquire about the release timeline for a security update.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which IBM products are affected by CVE-2026-109126?
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 are the affected versions.
How severe is this vulnerability?
The National Vulnerability Database rates it as high severity with a CVSS score of 8.8.
Is there a fix available for this issue?
No fix has been confirmed yet according to the provided source material.
