CVE-2026-19491 is a critical (CVSS 9.1) authentication bypass in IBM Security Verify Access 10.0 and IBM Verify Identity Access 11.0, including their container editions. A remote attacker can bypass authentication. IBM lists no workaround. Upgrade to Security Verify Access 10.0.9.4 or Verify Identity Access 11.0.3.2.
What's affected
The NVD record describes IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3. The container editions of both products are in scope.
The IBM bulletin we read gives a slightly wider range: 10.0 through 10.0.9.3 and 11.0 through 11.0.3.1. IBM names the fixed versions as IBM Security Verify Access 10.0.9.4 and IBM Verify Identity Access 11.0.3.2. If you run 10.0.9.3 or 11.0.3.1, treat yourself as affected, since the record's range stops one build short of IBM's.
Severity is 9.1 Critical in both the record and the bulletin. The weakness is CWE-287 (improper authentication). The record's KEV flag is false and the bulletin does not report exploitation. IBM states there are no mitigations or workarounds. The same bulletin covers CVE-2026-19498, a denial of service issue in the same products.
How to check if you're exposed
Find the product version in the appliance or container you run. For the virtual or hardware appliance, the firmware version is shown in the Local Management Interface under the system information pages. For containers, check the image tag you deployed and compare it to the fixed releases.
If you cannot find the version, follow the steps in the IBM bulletin, and ask whoever owns your identity infrastructure. Also list every application that trusts this product to authenticate users, because those applications inherit the risk. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, so it will not see operating system, firmware or driver issues like this one. For those, rely on your asset inventory and the vendor advisory.
What to do now
- Identify every Verify Access and Verify Identity Access instance, including test, staging and disaster recovery copies.
- Plan the upgrade to 10.0.9.4 or 11.0.3.2. For containers, use the images IBM points to in its bulletin.
- Upgrade internet facing and partner facing instances first.
- Since IBM lists no workaround, reduce exposure while you schedule the work. Restrict network access to management and authentication endpoints to the sources that need it.
- Review authentication logs for unusual successful logins, unfamiliar source addresses or sessions for accounts that were not in use.
- Record the version after the upgrade and confirm the application login flows still work.
Why it matters
Improper authentication is the weakness behind this flaw, and the product is an access gateway. When a component whose job is to decide who gets in can be bypassed, every protected application behind it loses its first line of defence at once.
The record's score is 9.1. That reflects a network attack path with no privileges and no user interaction needed, with high impact on confidentiality and integrity. IBM does not describe the mechanism in the page we read, and neither do we. The practical advice is simple: patch quickly, then check your logs for the period before the patch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a workaround?
IBM's bulletin says there are no mitigations or workarounds. The fix is to upgrade.
The record says 10.0.9.2 but IBM says 10.0.9.3. Which is right?
Use IBM's wider range. The record's upper bound is one build lower than the bulletin's affected products table, so anything up to 10.0.9.3 and 11.0.3.1 should be treated as affected.
Sources
Last reviewed: 18 October 2026.
