CVE-2026-19498 is a medium severity (CVSS 5.9) denial of service flaw in IBM Security Verify Access 10.0 and IBM Verify Identity Access 11.0, caused by uncontrolled recursion. A remote attacker can make the service fail. IBM lists no workaround, so upgrade to Verify Access 10.0.9.4 or Verify Identity Access 11.0.3.2.
What's affected
The record lists IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, with the container editions included. IBM's bulletin gives a wider range of 10.0 through 10.0.9.3 and 11.0 through 11.0.3.1. Where the two differ, use IBM's range.
The fixed versions in the bulletin are IBM Security Verify Access 10.0.9.4 and IBM Verify Identity Access 11.0.3.2. IBM says there are no workarounds or mitigations.
Both the record and the bulletin score it 5.9 (Medium). The weakness is CWE-674 (uncontrolled recursion). The KEV flag is false. The same bulletin fixes the critical authentication bypass CVE-2026-19491, so one upgrade covers both.
How to check if you're exposed
Read the product version from the appliance management interface, or the image tag for container deployments, and compare it with the fixed versions above. Anything below 10.0.9.4 on the 10.0 line, or below 11.0.3.2 on the 11.0 line, is affected based on the bulletin's ranges.
Because the flaw is a denial of service, also look at availability history. Repeated restarts or unexplained outages of the authentication service are worth a look in your monitoring. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, so it will not see operating system, firmware or driver issues like this one. For those, rely on your asset inventory and the vendor advisory.
What to do now
- Inventory all Verify Access and Verify Identity Access instances.
- Upgrade to 10.0.9.4 or 11.0.3.2 as part of the same change that fixes the authentication bypass.
- Run at least two instances behind a load balancer where you can, so one failing node does not take logins down.
- Set alerts on the authentication service health and restart counts.
- Confirm the version after the upgrade.
Why it matters
Uncontrolled recursion (CWE-674 (uncontrolled recursion)) happens when code calls itself on input without a limit. Enough nesting exhausts the stack or memory and the process dies. It is an old and well understood class of bug, and the usual fix is a depth limit.
The impact here is availability only. That sounds minor until you remember what the product does. If the login gateway stops responding, every application that depends on it becomes unreachable for users. A medium score on paper can be a high priority for an identity service.
Quick check
Does this expose data?
The record's description covers denial of service only. The related bypass in the same bulletin is the one that affects confidentiality and integrity.
Which upgrade should I choose?
The fixed versions named by IBM are 10.0.9.4 for Security Verify Access and 11.0.3.2 for Verify Identity Access. Check the bulletin for the container download page.
Sources
Last reviewed: 18 October 2026.
