CVE-2026-11888 is a medium severity flaw (CVSS 6.4) in IBM Security Verify Access and IBM Verify Identity Access. IBM describes it as an information disclosure issue. IBM lists upgrades to 10.0.9.4 for Verify Access and 11.0.3.2 for Verify Identity Access, with no workaround available.
What's affected
- IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, per the CVE description. The container editions are listed too.
- IBM's affected products table runs one patch level higher: Verify Access 10.0 to 10.0.9.3 and Verify Identity Access 11.0 to 11.0.3.1. This is a source conflict. Treat anything below the fixed builds as affected and confirm the exact boundary with IBM.
- Fixes in the bulletin: Verify Identity Access 11.0.3.2 (fix ID 11.0.3-ISS-IVIA-FP0002) and Verify Access 10.0.9.4 (fix ID 10.0.9-ISS-ISVA-FP0004). Container users follow IBM's container download page.
Severity: the record gives 6.4 Medium and IBM's bulletin gives the same base score. The record's weakness class is CWE-94, while IBM's text calls it information disclosure. Both are shown here because they describe the issue from different angles.
How to check if you're exposed
Check the firmware or fix level shown in the appliance management interface, or the image tag if you run the container edition. Compare it with the fixed builds above.
For containers, list the running image tags and look for the Verify Access or Verify Identity Access image:
kubectl get pods -A -o jsonpath='{..image}' | tr -s ' ' '\n' | sort -u
If the tag is below the fixed build, treat the instance as exposed. IBM's bulletin is the place to confirm exact fix package names for your deployment.
What to do now
- List every Verify Access and Verify Identity Access appliance and container in your estate.
- Upgrade to 10.0.9.4 or 11.0.3.2 (or later), using IBM Fix Central for appliances and IBM's container download page for containers.
- IBM lists no workaround, so schedule the upgrade rather than waiting for a mitigation.
- Remember that the same bulletin covers two more CVEs (CVE-2026-11930 and CVE-2026-12109), so one upgrade closes all three.
Why it matters
The record classifies this under CWE-94 (Code Injection), which usually means attacker-controlled input is interpreted as code or commands. IBM's own wording is more modest: an information disclosure attack. The vector requires a low privilege account and high attack complexity, which is why the score sits at 6.4 rather than higher.
Identity access gateways sit in front of many applications. Even a medium rated disclosure on that tier can expose configuration or session details that help a later attack. The record does not flag this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Patch it with the batch of three, not on its own.
Quick check
Is there a workaround?
IBM's bulletin lists none. Upgrading is the remedy.
Why do two version ranges appear?
The CVE description stops at 10.0.9.2 and 11.0.3, while IBM's table lists 10.0.9.3 and 11.0.3.1. Upgrade past both to be safe.
Sources
Last reviewed: 18 October 2026.
