How do I check whether I am affected by CVE-2026-109126?

Check the appliance firmware version (LMI dashboard or the appliance version info). Exposed if Verify Identity Access is exactly 11.0.3.1 or Security Verify Access is exactly 10.0.9.3. Bulletin lists no other affected versions.

What is the fix for CVE-2026-109126?

Update to IBM Verify Identity Access 11.0.3.2 or IBM Security Verify Access 10.0.9.4 (download from IBM Fix Central). No workaround per IBM. Restrict network access to the appliance management interfaces until patched.

Who is not affected by CVE-2026-109126?

Not affected if: no-physical-access-risk, not-on-affected-version, other-versions.

Live › vulnerability › CVE-2026-109126

Go to dashboard

high8.8Infrastructure

IBM Verify Access appliance: hard-coded credentials give local attacker elevated privileges

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 appliances contain hard-coded credentials (CWE-798). An attacker on the adjacent network (CVSS AV:A, no privileges needed) can gain elevated privileges. IBM lists no workaround; update the appliance. No known exploitation or public PoC.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: local.
Worst case: Attacker gains elevated privileges on the appliance using built-in credentials.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

2 products

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-109126

Go to dashboard

high8.8Infrastructure

IBM Verify Access appliance: hard-coded credentials give local attacker elevated privileges

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: local.
Worst case: Attacker gains elevated privileges on the appliance using built-in credentials.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

2 products

Know the next one before it finds you.

Add to Slack

IBM Verify Access appliance: hard-coded credentials give local attacker elevated privileges

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

IBM Verify Access appliance: hard-coded credentials give local attacker elevated privileges

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources

Product	Ecosystem	Affected	Fixed in
IBM Verify Identity Access	vendor	11.0.3.1	11.0.3.2
IBM Security Verify Access	vendor	10.0.9.3	10.0.9.4