CVE-2024-22330 is a medium severity (CVSS 5.9) flaw in IBM Security Verify Governance 10.0.2, which does not require strong passwords by default. IBM's fix is fix pack 5 for the Governance and Identity Manager virtual appliance components. Apply it and set a strict password policy.
What's affected
Per the IBM security bulletin (published 5 June 2025):
- IBM Security Verify Governance 10.0.2: fix is 10.0.2.0-ISS-ISVG-IGVA-FP0005.
- IBM Security Verify Governance, Identity Manager virtual appliance component, 10.0.2: fix is 10.0.2.0-ISS-ISVG-IMVA-FP0005.
IBM lists no workarounds or mitigations. The bulletin says it covers multiple vulnerabilities, so the same fix packs address more than this one CVE.
How to check if you're exposed
Check the version and fix pack level in the appliance console or administration interface and compare it with the fix pack names above.
Then check the actual password policy. In the identity governance product, review the password rules applied to local accounts, including administrators and service accounts. Look for minimum length, complexity and lockout settings that match your company policy.
IBM's bulletin is the reference for the exact installation steps for the fix packs.
What to do now
- Apply fix pack 10.0.2.0-ISS-ISVG-IGVA-FP0005 and the IMVA fix pack, following IBM's instructions.
- Review and tighten the password policy for local accounts.
- Force password changes for accounts that were created under the weak default.
- Prefer single sign-on with multi-factor authentication for administrators if your setup supports it.
- Turn on lockout and alerting for repeated failed logins.
Why it matters
The class is CWE-521, weak password requirements. The product accepted passwords that a guessing or credential stuffing attack can find. The score is moderate because the attacker must guess a password over the network, and the attack complexity is rated high.
The target is the point. An identity governance system decides who gets access to what. Taking over an account there can open doors elsewhere, so weak defaults on this class of tool deserve more attention than the number suggests.
There is also a lesson about defaults. Many products ship with permissive settings so that first-time setup is easy, and the settings stay that way for years. A quick audit of password length, complexity, lockout and multi-factor requirements across your identity and access tools is worth an afternoon, and it does not depend on any one CVE.
If your company reports on access controls to auditors, record the policy change and the date you applied the fix pack, so you can show the control was strengthened and when.
Quick check
Is a fix pack enough, or do I need to change passwords too?
Do both. The fix pack changes the default, but accounts created under the old default may still have weak passwords.
Sources
Last reviewed: 19 October 2026.
