CVE-2026-12005 (GCVE-0-2026-12005)

Vulnerability from cvelistv5 – Published: 2026-08-12 19:52 – Updated: 2026-08-13 03:56
VLAI
Title
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
Summary
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional operations by crafting a malicious HTTP request.
Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 00:00 UTC
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
ibm
References
URL Tags
https://www.ibm.com/support/pages/node/7283079 vendor-advisorypatch
Impacted products
Vendor Product Version
IBM Security Verify Access Affected: 10.0 , ≤ 10.0.9.2 (semver)
    cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*
 Create a notification for this product.
IBM Verify Identity Access Affected: 11.0 , ≤ 11.0.3 (semver)
    cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*
 Create a notification for this product.
IBM Verify Identity Access Container Affected: 11.0 , ≤ 11.0.3 (semver)
    cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:verify_identity_access_container:11.0.3:*:*:*:*:*:*:*
 Create a notification for this product.
IBM Security Verify Access Container Affected: 10.0 , ≤ 10.0.9.2 (semver)
    cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:security_verify_access_container:10.0.9.2:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12005",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T03:56:08.523Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*"
          ],
          "product": "Security Verify Access",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "10.0.9.2",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*"
          ],
          "product": "Verify Identity Access",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "11.0.3",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:verify_identity_access_container:11.0.3:*:*:*:*:*:*:*"
          ],
          "product": "Verify Identity Access Container",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "11.0.3",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access_container:10.0.9.2:*:*:*:*:*:*:*"
          ],
          "product": "Security Verify Access Container",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "10.0.9.2",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional operations by crafting a malicious HTTP request.\u003c/p\u003e"
            }
          ],
          "value": "IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional operations by crafting a malicious HTTP request."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T19:53:40.040Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7283079"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003eIBM encourages customers to update their systems promptly.\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eAppliance:\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003e\u003cstrong\u003eAffected Products and Versions\u003c/strong\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003cstrong\u003eFix availability\u003c/strong\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eIBM Verify Identity Access 11.0 - 11.0.3\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Security\u0026amp;product=ibm/Tivoli/IBM+Verify+Identity+Access\u0026amp;release=All\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=11.0.3.0-ISS-IVIA-IF0001\" rel=\"nofollow\"\u003eDownload IBM Verify Identity Access v11.0.3 IF1\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eIBM Security Verify Access 10.0.0 - 10.0.9.2\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Security\u0026amp;product=ibm/Tivoli/IBM+Security+Verify+Access\u0026amp;release=All\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=10.0.9.2-ISS-ISVA-IF0001\" rel=\"nofollow\"\u003eDownload IBM Security Verify Access v10.0.9.2 IF2\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/thead\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eContainer:\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://docs.verify.ibm.com/ibm-security-verify-access/docs/containers\" rel=\"nofollow\"\u003eContainer Download\u003c/a\u003e\u003c/p\u003e"
            }
          ],
          "value": "IBM encourages customers to update their systems promptly.\n\nAppliance:\nAffected Products and Versions\nFix availability\nIBM Verify Identity Access 11.0 - 11.0.3\nDownload IBM Verify Identity Access v11.0.3 IF1\nIBM Security Verify Access 10.0.0 - 10.0.9.2\nDownload IBM Security Verify Access v10.0.9.2 IF2\n\nContainer:\nContainer Download"
        }
      ],
      "title": "Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-12005",
    "datePublished": "2026-08-12T19:52:59.597Z",
    "dateReserved": "2026-06-11T17:17:51.974Z",
    "dateUpdated": "2026-08-13T03:56:08.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-12005\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2026-08-12T20:17:33.667\",\"lastModified\":\"2026-08-13T05:17:21.063\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional operations by crafting a malicious HTTP request.\"}],\"affected\":[{\"source\":\"psirt@us.ibm.com\",\"affectedData\":[{\"vendor\":\"IBM\",\"product\":\"Security Verify Access\",\"cpes\":[\"cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"10.0\",\"lessThanOrEqual\":\"10.0.9.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"IBM\",\"product\":\"Verify Identity Access\",\"cpes\":[\"cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"11.0\",\"lessThanOrEqual\":\"11.0.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"IBM\",\"product\":\"Verify Identity Access Container\",\"cpes\":[\"cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:verify_identity_access_container:11.0.3:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"11.0\",\"lessThanOrEqual\":\"11.0.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"IBM\",\"product\":\"Security Verify Access Container\",\"cpes\":[\"cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:security_verify_access_container:10.0.9.2:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"10.0\",\"lessThanOrEqual\":\"10.0.9.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-12T00:00:00+00:00\",\"id\":\"CVE-2026-12005\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7283079\",\"source\":\"psirt@us.ibm.com\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.