{"id":"CVE-2026-12109","state":"PUBLISHED","title":"Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access","description":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attacker with administrative privileges and access to the local management interface to execute arbitrary code due to an unbounded write to a fixed-size stack buffer.","publishedAt":"2026-10-08T21:01:50.629Z","updatedAt":"2026-10-10T12:11:40.490Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H","source":"ibm"},"assigner":"ibm","products":["IBM Security Verify Access","IBM Verify Identity Access","IBM Security Verify Access Container","IBM Verify Identity Access Container"],"affected":[{"vendor":"IBM","product":"Security Verify Access","versions":[{"version":"10.0","status":"affected","lessThanOrEqual":"10.0.9.2","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Verify Identity Access","versions":[{"version":"11.0","status":"affected","lessThanOrEqual":"11.0.3","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Security Verify Access Container","versions":[{"version":"10.0","status":"affected","lessThanOrEqual":"10.0.9.2","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:security_verify_access_container:10.0.9.2:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Verify Identity Access Container","versions":[{"version":"11.0","status":"affected","lessThanOrEqual":"11.0.3","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:verify_identity_access_container:11.0.3:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7291628"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/12xxx/CVE-2026-12109.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-12109","state":"PUBLISHED","datePublished":"2026-10-08T21:01:50.629Z","dateUpdated":"2026-10-10T12:11:40.490Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2026-06-12T14:37:43.722Z"},"containers":{"cna":{"title":"Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access","descriptions":[{"lang":"en","value":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attacker with administrative privileges and access to the local management interface to execute arbitrary code due to an unbounded write to a fixed-size stack buffer."}],"affected":[{"vendor":"IBM","product":"Security Verify Access","versions":[{"version":"10.0","status":"affected","lessThanOrEqual":"10.0.9.2","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Verify Identity Access","versions":[{"version":"11.0","status":"affected","lessThanOrEqual":"11.0.3","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Security Verify Access Container","versions":[{"version":"10.0","status":"affected","lessThanOrEqual":"10.0.9.2","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:security_verify_access_container:10.0.9.2:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Verify Identity Access Container","versions":[{"version":"11.0","status":"affected","lessThanOrEqual":"11.0.3","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:verify_identity_access_container:11.0.3:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7291628","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH","baseSeverity":"MEDIUM","baseScore":5.5,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","lang":"en","description":"CWE-787 Out-of-bounds Write","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2026-10-08T21:01:50.629Z"},"solutions":[{"lang":"en","value":"IBM encourages customers to update their systems promptly.\n\nAppliance:\nAffected Products\nFix availability\nIBM Verify Identity Access\nDownload IBM Verify Identity Access v11.0.3.1\nIBM Security Verify Access\nDownload IBM Security Verify Access v10.0.9.3\n\nContainer:\nContainer Download","supportingMedia":[{"type":"text/html","base64":false,"value":"<p><strong>IBM encourages customers to update their systems promptly.</strong></p><p></p><p><strong>Appliance:</strong></p><div><table><thead><tr><td><p><strong>Affected Products</strong></p></td><td><p><strong>Fix availability</strong></p></td></tr><tr><td><p>IBM Verify Identity Access</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FTivoli%2FIBM+Verify+Identity+Access&amp;fixids=11.0.3-ISS-IVIA-FP0001&amp;source=dbluesearch&amp;function=fixId&amp;parent=IBM%20Security\" rel=\"nofollow\">Download IBM Verify Identity Access v11.0.3.1</a></p></td></tr><tr><td><p>IBM Security Verify Access</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FIBM+Security+Verify+Access&amp;fixids=10.0.9-ISS-ISVA-FP0003&amp;source=SAR\" rel=\"nofollow\">Download IBM Security Verify Access v10.0.9.3</a></p></td></tr></thead></table></div><p></p><p><strong>Container:</strong></p><p><a href=\"https://docs.verify.ibm.com/ibm-security-verify-access/docs/containers\" rel=\"nofollow\">Container Download</a></p>"}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-10T03:55:52.448980Z","id":"CVE-2026-12109","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-10T12:11:40.490Z"}}]}}}