IBM SECURITY VERIFY DIRECTORY · CVE-2026-8639 · Infrastructure
FIX → 10.0.4.4 · 11.0.1.2 ✓ verified
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accept a session an attacker has set up before login. After a victim authenticates, the attacker can reuse that session to get unauthorized access to the directory management console.
first public Nov 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that self-host IBM Security Verify Directory 10.0.0-10.0.4 or IBM Verify Directory 11.0.0 and use its web administration console. An attacker with a low-privilege account (CVSS PR:L) can plant a session, and if an admin then logs in on it, the attacker takes over the directory management console. Teams not running these products can skip it.
Not affected if other-versions
Who cares ibm-security-verify-directory, ibm-verify-directory, identity, self-hosted, session-fixation
10.0.0 through 10.0.4) or IBM Verify Directory (affected: 11.0.0), including container deploymentsIBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
10.0.4.4 (v10) or 11.0.1.2 (v11) needs the updateUpgrade to 10.0.4.4 · 11.0.1.2
10.0.0-10.0.4 to v10.0.4.4 (https://www.ibm.com/support/pages/node/7292855); upgrade IBM Verify Directory 11.0.0 to v11.0.1.2 (https://www.ibm.com/support/pages/node/7290214)