{"id":"CVE-2026-8642","kind":"vulnerability","aliases":["CVE-2026-8642"],"related":[],"title":"IBM Verify Directory: debug endpoints leak server versions and session identifiers","description":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions.","summary":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 expose debug endpoints. These endpoints disclose system information, including server versions and session identifiers, which an attacker can use to find vulnerable software and possibly hijack sessions.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-verify-directory","identity","ldap","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-08T19:17:42+00:00","first_seen_at":"2026-11-08T19:22:35+00:00","triaged_at":"2026-11-08T19:23:23+00:00","updated_at":"2026-11-08T19:23:23+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T19:23:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"IBM Verify Directory: debug endpoints leak server versions and session identifiers","impact":"low","summary":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 expose debug endpoints. These endpoints disclose system information, including server versions and session identifiers, which an attacker can use to find vulnerable software and possibly hijack sessions.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-verify-directory","identity","ldap"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker learns server versions and session identifiers, enabling targeted attacks","analyst_note":"Check the IBM security bulletin for this CVE for fixed versions and whether the debug endpoints are enabled by default.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM Security Verify Directory 10.0.0 through 10.0.4 or IBM Verify Directory 11.0.0. The sources do not say which deployment configurations expose the debug endpoints or whether they are reachable from outside the network.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000701,"input_tokens":4556,"output_tokens":490,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-8642':14A,17A '10.0.0':29B,68C '10.0.4':31B,70C '11.0.0':36B,75C 'attack':53B 'cve':12A,15A 'debug':4A,38B,77C 'directori':3A,21B,28B,35B,67C,74C 'disclos':42B,80C 'endpoint':5A,39B,41B,78C 'expos':37B,76C 'find':57B 'hijack':62B 'ibm':1A,19B,25B,33B,64C,72C 'ibm-verify-directori':18B 'ident':22B 'identifi':11A,50B,88C,95C 'includ':45B,83C 'inform':44B,82C,90C 'ldap':23B 'leak':6A 'possibl':61B 'secur':26B,65C 'server':7A,46B,84C 'session':10A,49B,63B,87C 'softwar':59B,97C 'system':43B,81C 'use':55B,93C 'vendor':24B 'verifi':2A,20B,27B,34B,66C,73C 'version':8A,47B,85C,98C 'vulner':58B,96C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM Security Verify Directory 10.0.0 through 10.0.4 or IBM Verify Directory 11.0.0. The sources do not say which deployment configurations expose the debug endpoints or whether they are reachable from outside the network.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmverifydirectory","identity","ldap","medium","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-8642':14A,17A 'cve':12A,15A 'debug':4A 'directori':3A 'endpoint':5A 'ibm':1A 'identifi':11A 'leak':6A 'server':7A 'session':10A 'verifi':2A 'version':8A","search_b":"'10.0.0':29B '10.0.4':31B '11.0.0':36B 'attack':53B 'debug':38B 'directori':21B,28B,35B 'disclos':42B 'endpoint':39B,41B 'expos':37B 'find':57B 'hijack':62B 'ibm':19B,25B,33B 'ibm-verify-directori':18B 'ident':22B 'identifi':50B 'includ':45B 'inform':44B 'ldap':23B 'possibl':61B 'secur':26B 'server':46B 'session':49B,63B 'softwar':59B 'system':43B 'use':55B 'vendor':24B 'verifi':20B,27B,34B 'version':47B 'vulner':58B","search_c":"'10.0.0':68C '10.0.4':70C '11.0.0':75C 'debug':77C 'directori':67C,74C 'disclos':80C 'endpoint':78C 'expos':76C 'ibm':64C,72C 'identifi':88C,95C 'includ':83C 'inform':82C,90C 'secur':65C 'server':84C 'session':87C 'softwar':97C 'system':81C 'use':93C 'verifi':66C,73C 'version':85C,98C 'vulner':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-8642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8642","severity":null,"published_at":"2026-11-08T19:17:42+00:00","modified_at":"2026-11-08T19:17:42+00:00","first_seen_at":"2026-11-08T19:22:35+00:00","fetched_at":"2026-11-08T19:22:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}