CVE-2026-8642 · Vendor
NO FIX YET
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 expose debug endpoints. These endpoints disclose system information, including server versions and session identifiers, which an attacker can use to find vulnerable software and possibly hijack sessions.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running IBM Security Verify Directory 10.0.0 through 10.0.4 or IBM Verify Directory 11.0.0. The sources do not say which deployment configurations expose the debug endpoints or whether they are reachable from outside the network.
Not affected if unknown
Who cares ibm-verify-directory, identity, ldap
Unknown from the sources.
No fix yet, per the sources.
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.