CVE-2026-78388 is a medium severity (CVSS 4.3) cross-site request forgery in IBM Security Verify Access 10.0 and IBM Verify Identity Access 11.0. IBM fixed it in 10.0.9.4 and 11.0.3.2, along with other issues in the same bulletin. Plan to upgrade appliances and containers.
What's affected
The record lists IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, plus the container editions.
Version conflict: IBM's bulletin lists the affected range slightly wider in its table, as 10.0 through 10.0.9.3 and 11.0 through 11.0.3.1, while the individual CVE descriptions use the narrower 10.0.9.2 and 11.0.3 upper bounds. Both pages agree on the fix. Treat anything below the fixed versions as affected.
Fixes per IBM: IBM Security Verify Access 10.0.9.4 and IBM Verify Identity Access 11.0.3.2 for appliances, with updated container images. IBM lists no workarounds.
How to check if you're exposed
Check the firmware or software version in the appliance's management interface, or the image tag for container deployments.
docker images | grep -i verify
kubectl get pods -o jsonpath="{..image}" | tr ' ' '\n' | grep -i verify
Compare the result with the fixed versions above. Note that this is a combined bulletin. It lists many CVEs for these products, including some with a higher score than this CSRF issue, so check the whole list when you plan the change.
What to do now
- Upgrade to IBM Security Verify Access 10.0.9.4 or IBM Verify Identity Access 11.0.3.2, or the matching fixed container images, following IBM's download links.
- Treat the upgrade as the whole bulletin, not only this CVE. The same bulletin lists a 9.1 authentication bypass and a 9.8 item, so schedule it with priority.
- Restrict access to the management interfaces to administrator networks.
- Remind administrators not to browse other sites while logged in to the management console.
Why it matters
This is CWE-352, cross-site request forgery. A logged-in user's browser sends their session along with every request to the site. If the application does not check that a state-changing request was intended, a hostile page can make the browser send one. The record rates it low impact, integrity only, and requires user interaction.
The score is modest on its own. The reason to act is context: the bulletin covers an identity and access product, and its other entries include much more serious flaws. A single upgrade clears them together. The record carries no KEV flag, and IBM's bulletin does not mention exploitation.
Quick check
Is the CSRF flaw the main reason to patch?
Probably not. It is the lowest rated of the issues in IBM's bulletin, which also lists higher severity ones.
Do container deployments need a separate fix?
IBM provides updated container images, so redeploy them.
Sources
Last reviewed: 18 October 2026.
