CVE-2026-1346
IBM Verify Identity Access and Security Verify Access products (both container and non-container versions) contain a privilege escalation flaw. A locally authenticated user can exploit the issue to gain root privileges because the software runs with more privileges than necessary. The vulnerability affects specific versions listed in the advisory and has a critical CVSS score of 9.3.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of IBM Verify Identity Access Container 11.0 through 11.0.2, IBM Security Verify Access Container 10.0 through 10.0.9.1, IBM Verify Identity Access 11.0 through 11.0.2, and IBM Security Verify Access 10.0 through 10.0.9.1.
Real-world impact
An attacker with local authentication could elevate their privileges to root, potentially allowing full control of the affected system.
Why this severity
The CVSS v3.1 base score is 9.3 (Critical) due to low attack complexity, no privileges required, no user interaction, and high impacts to confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Apr 8, 2026 · Apr 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 25, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- ibm.com/support/pages/node/7268253vendor advisory