CVE-2026-16823 is a critical (CVSS 9.1) improper authentication flaw in IBM Security Verify Access and IBM Verify Identity Access. A remote attacker with no account can bypass security restrictions. IBM names fixed releases 10.0.9.4 and 11.0.3.2, and the version ranges differ between the record and the bulletin.
What's affected
IBM Security Verify Access and IBM Verify Identity Access, including their container editions. Here the sources disagree on the version range:
- The NVD record says IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3.
- IBM's bulletin, last modified 12 October 2026, lists 10.0 through 10.0.9.3 for Verify Access and 11.0 through 11.0.3.1 for Verify Identity Access, for both the appliance and container products.
The bulletin is the later and wider statement, so plan on it. The fixes IBM names are IBM Security Verify Access v10.0.9.4 and IBM Verify Identity Access v11.0.3.2 for the appliance, plus updated container images from the container download link in the bulletin. IBM lists no workarounds.
How to check if you're exposed
Read the version of each Verify Access or Verify Identity Access deployment from its management interface, and for containers read the image tag you deployed. Anything from 10.0 through 10.0.9.3, or 11.0 through 11.0.3.1, is in scope under IBM's bulletin. Do not stop at the lower numbers in the NVD record, because that would leave 10.0.9.3 and 11.0.3.1 unchecked.
Verify Access sits in front of applications as an access manager or reverse proxy, so also list which applications depend on each instance. That tells you the blast radius and the order in which to patch.
What to do now
- Inventory every Verify Access and Verify Identity Access appliance and container deployment.
- Compare versions against IBM's bulletin range, which is wider than the NVD record.
- Upgrade appliances to 10.0.9.4 or 11.0.3.2, and pull the updated container images.
- Limit management interface access to administrative networks while you patch.
- Review authentication and policy logs on front-end instances for unusual successful requests.
Why it matters
CWE-287 is improper authentication. The component does not correctly prove who a caller is before granting access. The vector shows network access, low complexity, no privileges and no user interaction, with high confidentiality and integrity impact and no availability impact. That is the shape of a flaw that can be reached by anyone who can see the service.
An access manager is a gatekeeper for other applications. A bypass there weakens everything behind it, not only the product itself. IBM issued one bulletin for this CVE and CVE-2026-16916, so one upgrade covers both. The record does not flag known exploitation, and the bulletin does not say it is exploited.
The weakness class here is CWE-287 (Improper Authentication). The NVD record scores it 9.1, which is critical severity. IBM's bulletin gives the same score but a wider version range, as noted above. The CVSS vector reads attack vector over the network, low attack complexity, no privileges required, no user interaction. Scope is unchanged. Impact on confidentiality, integrity and availability is rated high, high and none. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Try it yourself
A free in-browser dependency scan at gold.safeguard.sh/scan shows which of your components match known CVEs. The demo below walks through the idea.
Click through it at your own pace, or open it full screen.
Quick check
Which version range should I trust, the record or IBM?
Use IBM's bulletin. It lists 10.0 through 10.0.9.3 and 11.0 through 11.0.3.1, which includes releases the record's range leaves out.
Sources
- IBM security bulletin for Verify Access and Verify Identity Access
- Safeguard Gold entry for CVE-2026-16823, which summarizes the NVD record
Last reviewed: 18 October 2026.
