CVE-2026-16916 is a critical (CVSS 9.1) protection mechanism failure in IBM Security Verify Access and IBM Verify Identity Access. A remote authenticated attacker with high privileges can execute arbitrary code. IBM names fixed releases 10.0.9.4 and 11.0.3.2, and its version range is wider than the record.
What's affected
IBM Security Verify Access and IBM Verify Identity Access, including their container editions. Here the sources disagree on the version range:
- The NVD record says IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3.
- IBM's bulletin, last modified 12 October 2026, lists 10.0 through 10.0.9.3 for Verify Access and 11.0 through 11.0.3.1 for Verify Identity Access, for both the appliance and container products.
The bulletin is the later and wider statement, so plan on it. The fixes IBM names are IBM Security Verify Access v10.0.9.4 and IBM Verify Identity Access v11.0.3.2 for the appliance, plus updated container images from the container download link in the bulletin. IBM lists no workarounds.
How to check if you're exposed
Read the version of each Verify Access or Verify Identity Access deployment from its management interface, and for containers read the image tag you deployed. Anything from 10.0 through 10.0.9.3, or 11.0 through 11.0.3.1, is in scope under IBM's bulletin. Do not stop at the lower numbers in the NVD record, because that would leave 10.0.9.3 and 11.0.3.1 unchecked.
Verify Access sits in front of applications as an access manager or reverse proxy, so also list which applications depend on each instance. That tells you the blast radius and the order in which to patch.
What to do now
- List all Verify Access and Verify Identity Access appliances and containers.
- Match versions against IBM's range in bulletin 7291628, not only the NVD range.
- Upgrade to 10.0.9.4 or 11.0.3.2 and refresh container images.
- Audit which administrators hold high privilege roles, and remove stale ones.
- Place management access behind a restricted network path.
Why it matters
CWE-693 is protection mechanism failure, a broad class where a safeguard that should hold does not. IBM does not describe the mechanism. The record says an authenticated attacker can execute arbitrary code, and the vector requires high privileges, with scope changed.
The high privilege requirement lowers the odds, but it does not make the flaw harmless. Admin credentials get phished, reused and left behind by former staff. Combined with CVE-2026-16823 in the same bulletin, which needs no account at all, the case for patching both together is strong. The record does not mark either as known exploited.
The weakness class here is CWE-693 (Protection Mechanism Failure). The NVD record scores it 9.1, which is critical severity. IBM's bulletin gives the same score but a wider version range, as noted above. The CVSS vector reads attack vector over the network, low attack complexity, high privileges required, no user interaction. Scope is changed, meaning the impact can reach beyond the vulnerable component. Impact on confidentiality, integrity and availability is rated high, high and high. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Safeguard's Gold directory tracks this CVE, and reachability analysis helps you decide which affected components matter most for your own software.
Quick check
The attack needs high privileges. Can I wait?
It lowers the risk but does not remove it, and the sibling CVE in the same bulletin needs no account. Patch both with one upgrade.
Sources
- IBM security bulletin for Verify Access and Verify Identity Access
- Safeguard Gold entry for CVE-2026-16916, which summarizes the NVD record
Last reviewed: 18 October 2026.
