CVE-2025-36087 is a high severity (CVSS 8.1) hard-coded credentials flaw in IBM Security Verify Access 10.0.0 through 10.0.9 and 11.0, and the matching container images. IBM's fixes are Security Verify Access 10.0.9 IF2 and Verify Identity Access 11.0.1.
What's affected
IBM's bulletin lists these products and versions:
- IBM Security Verify Access 10.0 through 10.0.9
- IBM Verify Identity Access 11.0
- IBM Security Verify Access Container 10.0 through 10.0.9
- IBM Verify Identity Access Container 11.0
The flaw appears under certain configurations only. IBM describes hard-coded credentials, such as a password or cryptographic key, that the product uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
IBM's vector is network reachable with high attack complexity, no privileges and no user interaction. The record does not mark the flaw as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
- Find your product and version. For the appliance, check the firmware and fix pack level in the management interface. For containers, list the image tags in use, for example with kubectl or docker.
- Compare them with the list above. Versions 10.0.0 through 10.0.9 and 11.0 are named by IBM.
- IBM says only certain configurations are affected but does not publish a test in the bulletin. Ask IBM support which configurations apply to you if you cannot tell.
- Identify which Verify Access instances sit in front of sensitive applications, since an access gateway holds access decisions for others.
- Scan the container images you run. The free in-browser dependency scan at gold.safeguard.sh/scan is a starting point, and the Gold directory covers the CVE.
What to do now
- For the appliance on 10.0.0 through 10.0.9, install Security Verify Access v10.0.9 IF2 from IBM's download page.
- For Verify Identity Access 11.0, move to v11.0.1.
- For containers, pull and deploy the container images IBM lists for these releases.
- After patching, review the secrets and keys that the product holds. Rotate any you cannot be sure were unexposed.
- Limit network access to management interfaces.
IBM lists no workarounds or mitigations.
Why it matters
The class is CWE-798, use of hard-coded credentials. A secret baked into a product is the same in every installation. Anyone who learns it can use it against every deployment that has not changed it, and the customer often has no way to rotate it.
The product is an access management layer. A weakness here can affect confidentiality, integrity and availability of the applications it protects, which is why IBM's vector shows high impact in all three. High attack complexity holds the score at 8.1.
Quick check
Which fixed releases does IBM list?
Security Verify Access v10.0.9 IF2 for the 10.0 appliance, and Verify Identity Access v11.0.1. Container fixes are described in the bulletin.
Is there a workaround?
IBM lists none, so patching is the way to resolve it.
Sources
Last reviewed: 18 October 2026.
