CVE-2026-4938: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
IBM Security Verify Access could allow an attacker with read-only privileges to make unauthorized modifications and deployments outside of their assigned permissions.
Other sources
IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow an attacker with read-only privileges to make unauthorized modifications and deployments outside of their assigned permissions.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Security Verify Accessto a version that resolves this vulnerability.Fixed in 10.0.9.2 - Upgrade
Upgrade
IBM Verify Identity Accessto a version that resolves this vulnerability.Fixed in 11.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4938?
The severity of CVE-2026-4938 is medium with a score of 6.5.
How do I fix CVE-2026-4938?
To fix CVE-2026-4938, you should upgrade to the latest versions of IBM Verify Identity Access and IBM Security Verify Access as recommended by IBM.
What versions are affected by CVE-2026-4938?
CVE-2026-4938 affects IBM Verify Identity Access versions 11.0 through 11.0.2 and IBM Security Verify Access versions 10.0 through 10.0.9.1.
Who is vulnerable to CVE-2026-4938?
Organizations using the specified versions of IBM Verify Identity Access and IBM Security Verify Access are vulnerable to CVE-2026-4938.
What type of attack is related to CVE-2026-4938?
CVE-2026-4938 allows an attacker with read-only privileges to make unauthorized modifications, indicating a privilege escalation vulnerability.