CVE-2026-17616 is a medium severity flaw (CVSS 6.8) in the reverse proxy of IBM Security Verify Access and IBM Verify Identity Access. In certain configurations it provides weaker than expected cryptographic validation of user supplied data. IBM publishes the fixes in its support bulletin, so check it for your version.
What's affected
Per the CVE record:
- IBM Security Verify Access 10.0 through 10.0.9.2
- IBM Verify Identity Access 11.0 through 11.0.3
- IBM Verify Identity Access Container 11.0 through 11.0.3
The record says the issue appears only in certain configurations of the Reverse Proxy. It does not say which ones, so the bulletin is the place to confirm.
How to check if you're exposed
Look up the firmware or container image version you run for the Verify Access appliance or the Verify Identity Access container. Compare it with the ranges above. Then open IBM's bulletin and check whether your Reverse Proxy configuration is one of the affected ones. The record does not list a fixed version, so take that from IBM.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Inventory every Verify Access appliance and Verify Identity Access container you run.
- Read IBM's bulletin and note the fix or interim fix for your version.
- Apply the fix in a test environment, then in production.
- Review which reverse proxy junctions and authentication flows rely on user supplied data being validated.
Why it matters
The weakness class is CWE-310, cryptographic issues. In plain terms, data that came from a user was checked less strictly than the design intends. The CVSS vector shows a network attack with high complexity and low privileges, with high confidentiality and integrity impact and no availability impact.
A reverse proxy in front of identity services is a high trust position, so weak validation there deserves attention even at a medium score. The CVE is not in CISA's KEV list.
Quick check
Is this exploited in the wild?
The record does not say so and the CVE is not in CISA's KEV list.
Where do I find the fixed version?
In IBM's support bulletin. The CVE record gives only the affected ranges.
Sources
Last reviewed: 19 October 2026.
