IBM Patches 22 Verify Access Flaws, Including Critical Remote Code Execution Bugs

What happened?

IBM patched 22 vulnerabilities in Verify Identity Access and Security Verify Access, including two critical flaws allowing unauthenticated remote code execution across appliance and container deployments. The most severe bugs, CVE-2026-78401 and CVE-2026-78406, each carry a CVSS score of 9.8. Both involve deserializing untrusted data, a process where software rebuilds stored or transmitted data into objects without properly checking whether it is safe. The publicly listed advisory for CVE-2026-78401 confirms the risk of unauthenticated remote code execution.

Key details

• IBM patched 22 vulnerabilities in Verify Identity Access and Security Verify Access, including two critical unauthenticated remote code execution bugs.
• Two critical flaws CVE-2026-78401 and CVE-2026-78406 have CVSS score 9.8 and involve deserializing untrusted data without safety checks.
• Three additional vulnerabilities have CVSS scores of 9.1: CVE-2026-16916 allows authenticated high-privilege remote code execution, CVE-2026-16823 enables security restriction bypass, and CVE-2026-19491 allows authentication bypass.
• Two argument injection flaws CVE-2026-18740 and CVE-2026-19482 rated 8.8 let authenticated remote attackers perform unauthorized actions or execute arbitrary commands.
• CVE-2026-19493 rated 7.5 allows a remote attacker to write files through path traversal.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.