CVE-2026-11930 is a medium severity authorization flaw (CVSS 5.9) in IBM Security Verify Access and Verify Identity Access. IBM says authorization may not be enforced correctly for some web servers. The fixes are Verify Access 10.0.9.4 and Verify Identity Access 11.0.3.2.
What's affected
- IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including container editions, per the CVE description.
- IBM's affected products table goes one level higher (10.0.9.3 and 11.0.3.1). That is a conflict between the description and the bulletin table, so confirm the boundary with IBM and aim for the fixed builds.
- Fixed: Verify Access 10.0.9.4 (fix ID 10.0.9-ISS-ISVA-FP0004) and Verify Identity Access 11.0.3.2 (fix ID 11.0.3-ISS-IVIA-FP0002).
Severity: record and IBM both give 5.9 Medium. The vector shows network access, no privileges and high attack complexity, with an integrity impact only.
How to check if you're exposed
Find the installed fix level in the appliance management console, or the image tag for containers.
kubectl get pods -A -o jsonpath='{..image}' | tr -s ' ' '\n' | sort -u | grep -i verify
If you cannot tell which web servers on the appliance front your applications, ask the team that owns the reverse proxy configuration. The bulletin does not say which servers are affected, so assume any web server role on a vulnerable build could be.
What to do now
- Identify all Verify Access and Verify Identity Access instances, appliance and container.
- Upgrade to 10.0.9.4 or 11.0.3.2 or later.
- Because IBM lists no workaround, add the patch to the next change window and track it as an authorization defect.
- Review access logs on protected applications for requests that reached resources they should not have, going back to the date you first deployed an affected build.
Why it matters
The record maps this to CWE-285 (Improper Authorization). The gateway makes an access decision, and in some web server configurations that decision was not enforced. When authorization checks depend on every layer enforcing the same policy, one gap can let a request reach a resource that policy should have blocked.
The score is moderate because exploitation is rated high complexity and the impact is limited to integrity. It is not listed as exploited in the wild, and it is not in the CISA KEV catalog. Medium issues in access gateways still deserve a patch date, since attackers often chain them with other weaknesses.
Quick check
Does this need an account to exploit?
The vector says no privileges are required, but attack complexity is high.
Is there a workaround?
IBM's bulletin lists none.
Sources
Last reviewed: 18 October 2026.
