---
id: "CVE-2026-8639"
page: "https://infrastack.ai/live/CVE-2026-8639"
kind: "vulnerability"
aliases: ["CVE-2026-8639"]
title: "IBM Verify Directory: session fixation lets attackers hijack admin console logins"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "IBM Security Verify Directory", "fixed": ["10.0.4.4"], "affected": ">= 10.0.0, <= 10.0.4", "ecosystem": "vendor"}, {"name": "IBM Verify Directory", "fixed": ["11.0.1.2"], "affected": "11.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ibm-security-verify-directory", "ibm-verify-directory", "identity", "infrastructure", "self-hosted", "session-fixation"]
not_affected_if: ["other-versions"]
published_at: "2026-11-08T19:17:42+00:00"
first_seen_at: "2026-11-08T19:22:34+00:00"
updated_at: "2026-11-08T19:23:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8639", "first_seen_at": "2026-11-08T19:22:34+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-verify-directory-affected-multiple-vulnerabilities-cve-2026-8639-cve-2026-8640-cve-2026-8642-cve-2026-8860-1", "first_seen_at": "2026-11-08T19:23:46+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-verify-directory-affected-multiple-vulnerabilities-cve-2026-8639-cve-2026-8640-cve-2026-8642-cve-2026-8860-1"]}]
exploit_sources: []
---

# IBM Verify Directory: session fixation lets attackers hijack admin console logins

Link for people: https://infrastack.ai/live/CVE-2026-8639 (this .md is for agents)

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accept a session an attacker has set up before login. After a victim authenticates, the attacker can reuse that session to get unauthorized access to the directory management console.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM Security Verify Directory affected >= 10.0.0, <= 10.0.4 fixed 10.0.4.4
- vendor:IBM Verify Directory affected 11.0.0 fixed 11.0.1.2

## How to check

Check your installed version of IBM Security Verify Directory (affected: 10.0.0 through 10.0.4) or IBM Verify Directory (affected: 11.0.0), including container deployments. Anything below 10.0.4.4 (v10) or 11.0.1.2 (v11) needs the update. Also check whether the web administration console is reachable from untrusted networks.

## Fix

Upgrade IBM Security Verify Directory 10.0.0-10.0.4 to v10.0.4.4 (https://www.ibm.com/support/pages/node/7292855); upgrade IBM Verify Directory 11.0.0 to v11.0.1.2 (https://www.ibm.com/support/pages/node/7290214). IBM lists no workarounds or mitigations.

## Timeline

- 2026-11-08T19:22:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-8639
- 2026-11-08T19:23:46+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-verify-directory-affected-multiple-vulnerabilities-cve-2026-8639-cve-2026-8640-cve-2026-8642-cve-2026-8860-1 — Read IBM bulletin (23 Oct 2026): fixes 10.0.4.4 / 11.0.1.2; no workarounds. No exploitation or PoC found in sources checked.

## Documents

- [advisory] IBM Security Bulletin: Verify Directory multiple vulnerabilities (CVE-2026-8639 et al.) https://www.ibm.com/support/pages/security-bulletin-ibm-verify-directory-affected-multiple-vulnerabilities-cve-2026-8639-cve-2026-8640-cve-2026-8642-cve-2026-8860-1

## From the sources

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_