CVE-2023-43016: High Empty Password Account in IBM Verify Access

CVE-2023-43016 is a high severity (CVSS 7.3) flaw in IBM Security Verify Access, appliance and Docker, versions 10.0.0.0 through 10.0.6.1. A user account with an empty password could let a remote user log in to the server. IBM's bulletin points to a fix package for the appliance and a newer container image for Docker.

What's affected

IBM's security bulletin, first published January 9, 2024, lists these affected products and versions:

• IBM Security Verify Access Appliance: 10.0.0.0 through 10.0.6.1.
• IBM Security Verify Access Docker: 10.0.0.0 through 10.0.6.1.

The record uses the name IBM Security Access Manager Container for the same ranges.

For the fix, IBM tells Docker users to pull the latest container image from icr.io/isva/verify-access with the newest published tag. For the appliance, the bulletin gives the fix as 10.0.7-ISS-ISVA-FP0000 for 10.0.0.0 installations. IBM lists no workarounds or mitigations.

The same bulletin covers several other CVEs for the same product, so one upgrade closes more than this one. IBM's CVSS vector in the bulletin is version 3.0, while the record uses 3.1. Both give 7.3, so there is no severity conflict.

How to check if you're exposed

For the appliance, read the firmware version in the appliance management interface and compare it with 10.0.7 or later. For the Docker image, list the images in use and check the tag:

docker images icr.io/isva/verify-access
docker ps --format '{{.Names}} {{.Image}}'

Any tag in the 10.0.0.0 to 10.0.6.1 range is affected. Also review the user list of the product for accounts with no password set, and check authentication logs for logins you cannot explain.

What to do now

1. Take an inventory of every Verify Access appliance and container, and the version each runs.
2. Apply IBM's fix package 10.0.7-ISS-ISVA-FP0000 to appliances, following IBM's bulletin for the exact procedure.
3. Pull the latest published image for Docker deployments and redeploy, after reading IBM's tag notes.
4. Review accounts on the product and set strong passwords wherever one was empty or default.
5. Restrict network access to the management interfaces to administrative networks only.
6. Review authentication logs from before the patch for unexplained sign ins.

Why it matters

An account with an empty password is a plain hole. Anyone who can reach the login service and knows the account name can try it. The record's weaknesses are CWE-258 and CWE-521, which cover empty passwords in configuration and weak password requirements.

The vector is network based with no account and no user interaction, but the impact is rated low on each of confidentiality, integrity and availability, which is why the score stays at 7.3. For an access management product, though, any unauthorized login deserves attention, because the product sits in front of other systems. The KEV flag is false.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• IBM Security Bulletin: Multiple vulnerabilities in IBM Security Verify Access
• IBM X-Force Exchange entry 266154 (referenced in the record; content did not load when fetched)

Last reviewed: 19 October 2026.