CVE-2023-38369 is a medium severity (CVSS 6.2) weakness in IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1: Docker images do not require strong passwords by default, which makes account compromise easier. IBM says to pull the latest container and apply fix pack 10.0.7 for appliances.
What's affected
The record covers IBM Security Access Manager Container, versions 10.0.0.0 through 10.0.6.1. IBM's bulletin names the products as IBM Security Verify Access Docker and Verify Access Appliance, both 10.0.0.0 through 10.0.6.1. The weakness is that the Docker images do not require strong passwords by default. The record is dated 2024-02-07 and scores 6.2, Medium, with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, which means local access and confidentiality impact.
IBM's bulletin gives the same 6.2 score. The remediation is to obtain the latest container with a docker pull of the verify-access image from icr.io, using the latest published tag, and, for appliances, to apply fix pack 10.0.7-ISS-ISVA-FP0000. IBM lists no workarounds. The same bulletin covers other CVEs, including one that IBM rates 8.4, so read all of it.
Weakness class: CWE-521.
How to check if you're exposed
Check which image tag your containers run, and compare it with IBM's latest published tag.
docker images icr.io/isva/verify-access
docker ps --format '{{.Names}} {{.Image}}'
Then check the credentials your deployment uses. If any account still has a default or short password from the image, change it now. For appliances, read the firmware version in the appliance console.
What to do now
- List every Verify Access container and appliance and record versions.
- Pull the latest image tag IBM publishes and redeploy, or apply fix pack 10.0.7 on appliances.
- Replace any default or weak passwords with long unique ones stored in a secrets manager.
- Read the full IBM bulletin for the higher rated CVE it also covers.
- Restrict local access to the hosts that run these containers.
Why it matters
Defaults are the most widely shared weakness in any product, because they are the same in every deployment. If an image allows or ships a weak password and an administrator never changes it, an attacker with local access to a host or container can guess it. The vector requires local access, which is why the score is Medium.
The fix has two halves: IBM's update changes the default, and you still have to change any password that was set before the update. Secure defaults help only on new installs. The CVE is not on the CISA Known Exploited Vulnerabilities list, and IBM's bulletin does not report exploitation.
Weak password requirements mean a product ships, or accepts, passwords that are easy to guess. Defaults are the largest risk because they are the same in every deployment. A secure default forces a unique, strong password at first use and refuses known weak values.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does updating the image change passwords I already set?
Not necessarily. Review and change any default or weak password in place.
How serious is the same bulletin?
It also lists a CVE IBM rates 8.4, so treat the bulletin as a whole when scheduling the update.
Sources
Last reviewed: 19 October 2026.
