CVE-2026-4101 is an authentication bypass in IBM Verify Identity Access and IBM Security Verify Access, scored CVSS 8.1. Under certain load conditions an attacker could gain unauthorized access. IBM lists interim fixes 11.0.2 IF2 and 10.0.9.1 IF1. Apply the fix on internet facing nodes first.
What's affected
From IBM security bulletin 7268253, first published 31 March 2026:
- IBM Verify Identity Access 11.0 through 11.0.2, and the container
- IBM Security Verify Access 10.0 through 10.0.9.1, and the container
Fixes for the appliances:
- Verify Identity Access 11.0: IBM Verify Identity Access v11.0.2 IF2
- Security Verify Access 10.0: IBM Security Verify Access v10.0.9.1 IF1
For the container, the bulletin points to its own download. IBM lists no workarounds or mitigations. The same bulletin covers other CVEs in these products, so read it in full.
How to check if you're exposed
Find your version in the appliance administration interface and compare it with the ranges above. For containers, check the image tag you deploy:
docker images | grep -i verify
kubectl get pods -A -o jsonpath='{..image}' | tr ' ' '\n' | grep -i verify
If you are in range and have not applied the interim fix, treat the system as exposed. Review authentication logs for sign ins that look out of place during periods of heavy load.
What to do now
- Open IBM bulletin 7268253 and download the interim fix for your product and version.
- Apply it in a maintenance window, starting with the instances that face the internet.
- For containers, update to the image IBM lists and redeploy.
- Review authentication and access logs for unexpected successful sign ins.
- Subscribe to IBM notifications for these products.
Why it matters
The weakness is CWE-287, improper authentication. IBM describes the trigger as certain load conditions, which suggests a race or timing problem in the authentication path and not a missing check. I did not find more detail than that in the bulletin, so I will not guess at the mechanism.
An access gateway sits in front of other applications. If it admits the wrong person, everything it protects is exposed. The CVSS vector is network reachable with high complexity. The record does not flag exploitation in the wild.
Quick check
Is there a workaround?
IBM lists none in the bulletin. Apply the interim fix.
Sources
Last reviewed: 19 October 2026.
