CVE-2026-17616

Assessment

Why it matters

EPSS is 0.3%; technical severity is CVSS 9.8.

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.

Who should care

• Teams operating Security Verify Access, Security Verify Access Container, Verify Identity Access +1 more
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Security Verify Access, Security Verify Access Container, Verify Identity Access +1 more is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. IBM Security advisory 7283079
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-310

Affected versions

IBM Security Verify Access (Start Including 10.0.0, End Excluding 10.0.9.2 | Version 10.0.9.2 | Version 10.0.9.2); IBM Security Verify Access Container (Start Including 10.0.0.0, End Including 10.0.9.2); IBM Verify Identity Access (Start Including 11.0, End Excluding 11.0.3 | Version 11.0.3); IBM Verify Identity Access Container (Start Including 11.0.0.0, End Including 11.0.3)

Fixed versions

IBM Security Verify Access (Fixed from 10.0.9.2); IBM Verify Identity Access (Fixed from 11.0.3)

Published

12 August 2026

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 12 Aug 2026CVE published
2. 22 Aug 2026Latest EPSS score: 0.3%
3. 19 Aug 2026 · 13:56 UTCSignal calculated at 14