{"id":"CVE-2026-109126","kind":"vulnerability","aliases":["CVE-2026-109126"],"related":[],"title":"IBM Verify Access appliance: hard-coded credentials give local attacker elevated privileges","description":"IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.","summary":"IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 appliances contain hard-coded credentials (CWE-798). An attacker on the adjacent network (CVSS AV:A, no privileges needed) can gain elevated privileges. IBM lists no workaround; update the appliance. No known exploitation or public PoC.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM Verify Identity Access","fixed":["11.0.3.2"],"affected":"11.0.3.1","ecosystem":"vendor"},{"name":"IBM Security Verify Access","fixed":["10.0.9.4"],"affected":"10.0.9.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["appliance","ibm-security-verify-access","ibm-verify-identity-access","identity","infrastructure","self-hosted"],"not_affected_if":["no-physical-access-risk","not-on-affected-version","other-versions"],"how_to_check":"Check the appliance firmware version (LMI dashboard or the appliance version info). Exposed if Verify Identity Access is exactly 11.0.3.1 or Security Verify Access is exactly 10.0.9.3. Bulletin lists no other affected versions.","fix":"Update to IBM Verify Identity Access 11.0.3.2 or IBM Security Verify Access 10.0.9.4 (download from IBM Fix Central). No workaround per IBM. Restrict network access to the appliance management interfaces until patched.","status":"open","published_at":"2026-10-20T00:17:30+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:32:58+00:00","updated_at":"2026-10-24T00:19:04+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:32:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"IBM Verify Access appliance: hard-coded credentials give local attacker elevated privileges","impact":"high","summary":"IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 appliances ship with hard-coded credentials. A physically nearby attacker can use them to gain elevated privileges on the appliance.","category":"infrastructure","who_cares":["ibm-security-verify-access","appliance","identity"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker gains elevated privileges on the appliance using built-in credentials","analyst_note":"Check IBM's security bulletin for affected builds and the fixed version, and whether the credentials can be changed by the customer; source is NVD only.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-versions","no-physical-access-risk"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000473,"input_tokens":2903,"output_tokens":366,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for affected builds and the fixed version, and whether the credentials can be changed by the customer; source is NVD only.","search":"'-109126':16A,19A '-2026':15A,18A '-798':62B '10.0.9.3':54B,102C '11.0.3.1':48B,96C 'access':3A,23A,27A,33B,38B,47B,53B,95C,101C 'adjac':67B 'allow':105C 'applianc':4A,28B,55B,85B,103C 'attack':11A,64B,109C 'av':70B 'code':7A,59B,121C 'contain':56B 'could':104C 'credenti':8A,60B,122C 'cve':14A,17A 'cvss':69B 'cwe':61B 'due':114C 'elev':12A,77B,112C 'exploit':88B 'gain':76B,111C 'give':9A 'hard':6A,58B,120C 'hard-cod':5A,57B,119C 'host':43B 'ibm':1A,20A,24A,30B,35B,44B,50B,79B,92C,98C 'ibm-security-verify-access':29B 'ibm-verify-identity-access':34B 'ident':37B,39B,46B,94C 'identity':22A 'infrastructur':40B 'known':87B 'list':80B 'local':10A 'need':74B 'network':68B 'physic':107C 'poc':91B 'privileg':13A,73B,78B,113C 'proxim':108C 'public':90B 'secur':31B,51B,99C 'security':25A 'self':42B 'self-host':41B 'updat':83B 'use':117C 'verifi':2A,32B,36B,45B,52B,93C,100C 'verify':21A,26A 'workaround':82B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T00:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109126","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109126","severity":null,"published_at":"2026-10-20T00:17:30+00:00","modified_at":"2026-10-20T15:17:10+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109126:633","url":null,"severity":null,"published_at":"2026-10-24T00:19:04+00:00","modified_at":"2026-10-24T00:19:04+00:00","first_seen_at":"2026-10-24T00:19:04+00:00","fetched_at":"2026-10-24T00:19:04+00:00","note":"IBM bulletin (primary) read: affected 11.0.3.1 / 10.0.9.3, fixed 11.0.3.2 / 10.0.9.4, no workaround. Bulletin does not say whether customers can change the credentials. No exploitation or PoC found; social not searched (obscure). CVSS vector is AV:A (adjacent network), so the 'physical' wording in the CVE is looser than the vector."}],"documents":[{"id":2540,"url":"https://www.ibm.com/support/pages/security-bulletin-security-vulnerability-has-been-found-ibm-verify-identity-access-and-ibm-security-verify-access-cve-2026-109126","title":"IBM Security Bulletin: CVE-2026-109126 Verify Identity Access / Security Verify Access","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2542,"url":"https://www.cve.org/CVERecord?id=CVE-2026-109126","title":"CVE Record CVE-2026-109126","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}