CVE-2023-38371 is a medium severity (CVSS 5.9) flaw in IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1: weaker than expected cryptographic algorithms could let an attacker decrypt sensitive information. IBM's bulletin points to a refreshed container image and fix pack 10.0.8 for appliances.
What's affected
The record lists IBM Security Access Manager Docker, versions 10.0.0.0 through 10.0.7.1. IBM's bulletin names IBM Security Verify Access Docker for those versions, and lists the appliance fix for 10.0.0.0 through 10.0.7.0. The weakness is the use of weaker than expected cryptographic algorithms. The record is dated 2024-06-27 and scores 5.9, Medium, with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. IBM's bulletin gives the same score.
IBM's remediation is to pull the latest verify-access container image using the latest published tag, and for appliances to apply fix pack 10.0.8-ISS-ISVA-FP0000. IBM lists no workarounds. The bulletin covers several other CVEs, so read it as a whole. The record also references two Full Disclosure postings from November 2024, which I did not need to rely on.
Weakness class: CWE-327.
How to check if you're exposed
Check the image tag and version your deployment uses.
docker images icr.io/isva/verify-access
Compare the tag with IBM's latest published tag. For appliances, read the firmware version in the console and confirm that fix pack 10.0.8 is applied. Also note which services use this deployment to protect traffic, since the exposure depends on what an attacker could capture.
What to do now
- Record the version of every Verify Access container and appliance.
- Pull IBM's latest image and redeploy, or install fix pack 10.0.8 on appliances.
- Check TLS and encryption settings in your own configuration and remove legacy algorithms you do not need.
- Read the whole IBM bulletin and plan for the other CVEs it lists.
- Rotate secrets that may have been protected with the weaker algorithms.
Why it matters
Weak cryptography matters when data is captured. If an attacker can record encrypted traffic or stored values, a weak algorithm may let them recover the contents later, offline, with no further contact with your system. The high attack complexity in the vector reflects that conditions have to line up, which is why the score is Medium.
The practical defence is to move to current algorithms and to retire the old ones. Keep an inventory of where your access manager protects traffic or tokens, since those are the values worth recovering. The CVE is not on the CISA Known Exploited Vulnerabilities list, and IBM's bulletin does not report exploitation.
Use of a broken or risky cryptographic algorithm means data is protected with a method that is weaker than current practice. Attackers who capture the protected data may be able to recover the plaintext offline. The fix is to move to current algorithms and key sizes and to retire the old ones, not just add the new ones alongside.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Quick check
What do I install?
IBM says to pull the latest verify-access container image, and for appliances to apply fix pack 10.0.8-ISS-ISVA-FP0000.
Is there a workaround?
IBM lists none.
Sources
Last reviewed: 19 October 2026.
