CVE-2026-12109 is a medium severity out-of-bounds write (CVSS 5.5) in IBM Security Verify Access and Verify Identity Access. An attacker with administrative privileges and access to the local management interface could execute code. IBM's fixes are Verify Access 10.0.9.4 and Verify Identity Access 11.0.3.2.
What's affected
- IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, container editions included, per the CVE description.
- IBM's table lists one patch level more (10.0.9.3 and 11.0.3.1). Treat that as a conflict and confirm with IBM. Anything below the fixed builds should be considered affected.
- Fixed: Verify Access 10.0.9.4 (10.0.9-ISS-ISVA-FP0004) and Verify Identity Access 11.0.3.2 (11.0.3-ISS-IVIA-FP0002).
Severity: record and IBM agree on 5.5 Medium. The vector requires high privileges and high attack complexity, which keeps the score low even though code execution is possible.
How to check if you're exposed
Check the fix level in the management console or the container image tag, and compare with the fixed builds.
Because the flaw needs administrative access to the local management interface, also check who can reach that interface. If the management network is open to many hosts, the practical exposure is higher than the score suggests.
kubectl get pods -A -o jsonpath='{..image}' | tr -s ' ' '\n' | sort -u | grep -i verify
What to do now
- Upgrade to 10.0.9.4 or 11.0.3.2 or later.
- Restrict the management interface to a small, monitored admin network.
- Review who holds administrative accounts on these products and remove any that are unused.
- IBM lists no workaround, so treat the upgrade as the control.
Why it matters
The record classifies the issue as CWE-787 (Out-of-bounds Write). IBM describes an unbounded write to a fixed-size stack buffer. When input larger than the buffer is copied in without a size check, adjacent memory is overwritten, which can give an attacker control of execution.
The privilege and complexity requirements make this a second-stage risk. An attacker who has already obtained admin credentials could turn that into code execution on the appliance itself. The record does not list the CVE as exploited, and it is not in CISA KEV. Hardening the management plane reduces the risk until the patch lands.
A useful habit with a bulletin like this one is to patch every CVE it lists in a single change. IBM's Verify Access bulletin carries three issues, so a single upgrade to the fixed builds removes all of them, and a rollback plan for the gateway is worth writing before the window opens.
Quick check
Can an unauthenticated attacker use this?
No. IBM says it needs administrative privileges and access to the local management interface.
Why patch a medium issue?
Code execution on an identity gateway is a serious outcome, and the upgrade also closes two related CVEs.
Sources
Last reviewed: 18 October 2026.
