CVE-2026-11932 is a medium severity denial of service flaw (CVSS 5.3) in IBM Security Verify Access and Verify Identity Access, including container editions. The cause is an infinite loop. IBM's remedy is an interim fix: 11.0.3 IF1 or 10.0.9.2 IF2 for appliances.
What's affected
- IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, plus Verify Identity Access Container 11.0 through 11.0.3.
- Fixes in IBM's bulletin: IBM Verify Identity Access 11.0.3 IF1 or IBM Security Verify Access 10.0.9.2 IF2, from IBM Fix Central. For containers, IBM points to its container download page.
- Workarounds: none.
Severity: the record and IBM both give CVSS 5.3 Medium (vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Only availability is affected.
Note that this CVE sits in a different IBM bulletin (7283079) from the other three Verify Access CVEs in this batch of posts, and the fix packages differ. Check each bulletin.
How to check if you're exposed
Check the installed interim fix in the appliance management interface. For containers, check the image tag against IBM's current container release.
kubectl get deploy -A -o wide | grep -i verify
If you cannot find the fix level on a given appliance, assume it is not applied. Availability monitoring on the gateway tier helps too: look for CPU pegged at a high level on a worker that is not serving traffic.
What to do now
- Inventory Verify Access and Verify Identity Access deployments.
- Install the interim fix that matches your product line from IBM Fix Central, or move containers to the fixed image IBM lists.
- Confirm the fix level after installation and record it.
- Add an alert for sustained high CPU on the gateway tier, since an infinite loop shows up as resource exhaustion.
Why it matters
The record classes this as CWE-835 (Loop with Unreachable Exit Condition), also called an infinite loop. A request or input drives a code path into a loop that never ends, and a worker is consumed until the service degrades. The impact is availability only, which explains the 5.3 score.
For an identity gateway, even a low rated denial of service can matter, because applications behind it cannot authenticate users while the gateway is struggling. It is unauthenticated and needs only network access, according to the vector. The record does not flag it as exploited, and it is not in CISA KEV.
Quick check
What fix does IBM give?
Interim fix 11.0.3 IF1 for Verify Identity Access or 10.0.9.2 IF2 for Verify Access, from IBM Fix Central.
Does it affect confidentiality?
No. The vector shows availability impact only.
Sources
Last reviewed: 18 October 2026.
