{"id":"CVE-2026-8639","kind":"vulnerability","aliases":["CVE-2026-8639"],"related":[],"title":"IBM Verify Directory: session fixation lets attackers hijack admin console logins","description":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console.","summary":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accept a session an attacker has set up before login. After a victim authenticates, the attacker can reuse that session to get unauthorized access to the directory management console.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM Security Verify Directory","fixed":["10.0.4.4"],"affected":">= 10.0.0, <= 10.0.4","ecosystem":"vendor"},{"name":"IBM Verify Directory","fixed":["11.0.1.2"],"affected":"11.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-security-verify-directory","ibm-verify-directory","identity","infrastructure","self-hosted","session-fixation"],"not_affected_if":["other-versions"],"how_to_check":"Check your installed version of IBM Security Verify Directory (affected: 10.0.0 through 10.0.4) or IBM Verify Directory (affected: 11.0.0), including container deployments. Anything below 10.0.4.4 (v10) or 11.0.1.2 (v11) needs the update. Also check whether the web administration console is reachable from untrusted networks.","fix":"Upgrade IBM Security Verify Directory 10.0.0-10.0.4 to v10.0.4.4 (https://www.ibm.com/support/pages/node/7292855); upgrade IBM Verify Directory 11.0.0 to v11.0.1.2 (https://www.ibm.com/support/pages/node/7290214). IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-08T19:17:42+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","triaged_at":"2026-11-08T19:23:06+00:00","updated_at":"2026-11-08T19:23:46+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-08T19:23:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Verify Directory: session fixation lets attackers hijack admin console logins","impact":"high","summary":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accept a session an attacker has set up before login. After a victim authenticates, the attacker can reuse that session to get unauthorized access to the directory management console.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-security-verify-directory","ibm-verify-directory","identity","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker gains unauthorized access to the directory management console","analyst_note":"Check IBM's security bulletin for CVE-2026-8639 for the fixed version and mitigations; the sources here only give the NVD description.","how_to_check":"- Confirm whether you run IBM Security Verify Directory `10.0.0` through `10.0.4` or IBM Verify Directory `11.0.0`.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Organisations running IBM Security Verify Directory 10.0.0 through 10.0.4 or IBM Verify Directory 11.0.0 where administrators log into the directory management console. Deployments outside these versions are not covered by the sources. The sources do not describe further configuration conditions.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4569,"output_tokens":569,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for CVE-2026-8639 for the fixed version and mitigations; the sources here only give the NVD description.","search":"'-2026':13A,16A '-8639':14A,17A '10.0.0':46B,87C '10.0.4':48B,89C '11.0.0':53B,94C 'accept':54B 'access':77B,118C 'admin':9A 'attack':7A,58B,69B,101C 'authent':67B,110C,113C 'consol':10A,82B,123C 'cve':12A,15A 'directori':3A,29B,33B,45B,52B,80B,86C,93C,121C 'directory':21A,24A 'establish':103C 'fixat':5A,41B,99C 'gain':116C 'get':75B 'hijack':8A,111C 'host':38B 'ibm':1A,18A,22A,26B,31B,42B,50B,83C,91C 'ibm-security-verify-directori':25B 'ibm-verify-directori':30B 'ident':34B 'infrastructur':35B 'let':6A 'login':11A,63B 'manag':81B,122C 'reus':71B 'secur':27B,43B,84C 'security':19A 'self':37B 'self-host':36B 'session':4A,40B,56B,73B,98C,105C,114C 'session-fix':39B 'set':60B 'unauthor':76B,117C 'verifi':2A,28B,32B,44B,51B,85C,92C 'verify':20A,23A 'victim':66B,109C 'vulner':96C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host IBM Security Verify Directory 10.0.0-10.0.4 or IBM Verify Directory 11.0.0 and use its web administration console. An attacker with a low-privilege account (CVSS PR:L) can plant a session, and if an admin then logs in on it, the attacker takes over the directory management console. Teams not running these products can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-08T19:23:46Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-verify-directory-affected-multiple-vulnerabilities-cve-2026-8639-cve-2026-8640-cve-2026-8642-cve-2026-8860-1","run_id":2216},"products":{"at":"2026-11-08T19:23:46Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-verify-directory-affected-multiple-vulnerabilities-cve-2026-8639-cve-2026-8640-cve-2026-8642-cve-2026-8860-1","run_id":2216},"mitigations":{"at":"2026-11-08T19:23:46Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-verify-directory-affected-multiple-vulnerabilities-cve-2026-8639-cve-2026-8640-cve-2026-8642-cve-2026-8860-1","run_id":2216},"workarounds":{"at":"2026-11-08T19:23:46Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-verify-directory-affected-multiple-vulnerabilities-cve-2026-8639-cve-2026-8640-cve-2026-8642-cve-2026-8860-1","run_id":2216},"how_to_check":{"at":"2026-11-08T19:23:46Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-verify-directory-affected-multiple-vulnerabilities-cve-2026-8639-cve-2026-8640-cve-2026-8642-cve-2026-8860-1","run_id":2216},"who_affected":{"at":"2026-11-08T19:23:46Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-verify-directory-affected-multiple-vulnerabilities-cve-2026-8639-cve-2026-8640-cve-2026-8642-cve-2026-8860-1","run_id":2216}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ibmsecurityverifydirectory","ibmverifydirectory","securityverifydirectory","verifydirectory"],"ptokens":["directory","ibm","security","verify"],"labels":["high","ibmsecurityverifydirectory","ibmverifydirectory","identity","infrastructure","selfhosted","sessionfixation"],"campaign_type":null,"search_a":"'-2026':13A,16A '-8639':14A,17A 'admin':9A 'attack':7A 'consol':10A 'cve':12A,15A 'directori':3A 'directory':21A,24A 'fixat':5A 'hijack':8A 'ibm':1A,18A,22A 'let':6A 'login':11A 'security':19A 'session':4A 'verifi':2A 'verify':20A,23A","search_b":"'10.0.0':46B '10.0.4':48B '11.0.0':53B 'accept':54B 'access':77B 'attack':58B,69B 'authent':67B 'consol':82B 'directori':29B,33B,45B,52B,80B 'fixat':41B 'get':75B 'host':38B 'ibm':26B,31B,42B,50B 'ibm-security-verify-directori':25B 'ibm-verify-directori':30B 'ident':34B 'infrastructur':35B 'login':63B 'manag':81B 'reus':71B 'secur':27B,43B 'self':37B 'self-host':36B 'session':40B,56B,73B 'session-fix':39B 'set':60B 'unauthor':76B 'verifi':28B,32B,44B,51B 'victim':66B","search_c":"'10.0.0':87C '10.0.4':89C '11.0.0':94C 'access':118C 'attack':101C 'authent':110C,113C 'consol':123C 'directori':86C,93C,121C 'establish':103C 'fixat':99C 'gain':116C 'hijack':111C 'ibm':83C,91C 'manag':122C 'secur':84C 'session':98C,105C,114C 'unauthor':117C 'verifi':85C,92C 'victim':109C 'vulner':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-8639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8639","severity":null,"published_at":"2026-11-08T19:17:42+00:00","modified_at":"2026-11-08T19:17:42+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","fetched_at":"2026-11-08T19:22:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-8639:2216","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-verify-directory-affected-multiple-vulnerabilities-cve-2026-8639-cve-2026-8640-cve-2026-8642-cve-2026-8860-1","severity":null,"published_at":"2026-11-08T19:23:46+00:00","modified_at":"2026-11-08T19:23:46+00:00","first_seen_at":"2026-11-08T19:23:46+00:00","fetched_at":"2026-11-08T19:23:46+00:00","note":"Read IBM bulletin (23 Oct 2026): fixes 10.0.4.4 / 11.0.1.2; no workarounds. No exploitation or PoC found in sources checked.","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-verify-directory-affected-multiple-vulnerabilities-cve-2026-8639-cve-2026-8640-cve-2026-8642-cve-2026-8860-1"]}],"documents":[{"id":103192,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-verify-directory-affected-multiple-vulnerabilities-cve-2026-8639-cve-2026-8640-cve-2026-8642-cve-2026-8860-1","title":"IBM Security Bulletin: Verify Directory multiple vulnerabilities (CVE-2026-8639 et al.)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}