By Forkast
Publication Date: 2026-10-14 08:16:00
Analysis
The management interface of IBM Security Verify Access processes untrusted data in a way that allows an unauthenticated remote attacker to execute arbitrary code. It is not an authentication bypass; the system processes the malicious payload directly.
The management interface of IBM Security Verify Access processes untrusted data in a way that allows an unauthenticated remote attacker to execute arbitrary code. This vulnerability, tracked as CVE-2026-78401, stems from improper deserialization, classified as CWE-502. It is not an authentication bypass; the system processes the malicious payload directly, leading to code execution without requiring a valid login.
IBM disclosed the issue in a security bulletin on October 7, 2026. The company assigned a CVSS 3.1 score of 9.8, marking it as critical. Note that this rating originates from IBM, as the National Vulnerability Database has not yet indexed the entry. There is no evidence of exploitation in the wild, and the flaw does…
