---
id: "CVE-2026-109126"
kind: "vulnerability"
aliases: ["CVE-2026-109126"]
title: "IBM Verify Access appliance: hard-coded credentials give local attacker elevated privileges"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "IBM Verify Identity Access", "fixed": ["11.0.3.2"], "affected": "11.0.3.1", "ecosystem": "vendor"}, {"name": "IBM Security Verify Access", "fixed": ["10.0.9.4"], "affected": "10.0.9.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["appliance", "ibm-security-verify-access", "ibm-verify-identity-access", "identity", "infrastructure", "self-hosted"]
not_affected_if: ["no-physical-access-risk", "not-on-affected-version", "other-versions"]
published_at: "2026-10-20T00:17:30+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-24T00:19:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109126", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:19:04+00:00"}]
---

# IBM Verify Access appliance: hard-coded credentials give local attacker elevated privileges

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 appliances contain hard-coded credentials (CWE-798). An attacker on the adjacent network (CVSS AV:A, no privileges needed) can gain elevated privileges. IBM lists no workaround; update the appliance. No known exploitation or public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM Verify Identity Access affected 11.0.3.1 fixed 11.0.3.2
- vendor:IBM Security Verify Access affected 10.0.9.3 fixed 10.0.9.4

## How to check

Check the appliance firmware version (LMI dashboard or the appliance version info). Exposed if Verify Identity Access is exactly 11.0.3.1 or Security Verify Access is exactly 10.0.9.3. Bulletin lists no other affected versions.

## Fix

Update to IBM Verify Identity Access 11.0.3.2 or IBM Security Verify Access 10.0.9.4 (download from IBM Fix Central). No workaround per IBM. Restrict network access to the appliance management interfaces until patched.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109126
- 2026-10-24T00:19:04+00:00 analyst — IBM bulletin (primary) read: affected 11.0.3.1 / 10.0.9.3, fixed 11.0.3.2 / 10.0.9.4, no workaround. Bulletin does not say whether customers can change the credentials. No exploitation or PoC found; social not searched (obscure). CVSS vector is AV:A (adjacent network), so the 'physical' wording in the CVE is looser than the vector.

## Documents

- [advisory] IBM Security Bulletin: CVE-2026-109126 Verify Identity Access / Security Verify Access https://www.ibm.com/support/pages/security-bulletin-security-vulnerability-has-been-found-ibm-verify-identity-access-and-ibm-security-verify-access-cve-2026-109126
- [mentions] CVE Record CVE-2026-109126 https://www.cve.org/CVERecord?id=CVE-2026-109126

## From the sources

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_