{"id":"CVE-2026-16916","published":"2026-10-08T21:17:56.500","lastModified":"2026-10-10T13:17:31.900","description":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-693"],"vendors":["ibm"],"products":["security verify access","security verify access container","verify identity access","verify identity access container"],"references":[{"url":"https://www.ibm.com/support/pages/node/7291628","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A remote attacker with valid credentials can exploit a protection mechanism failure in IBM Security Verify Access and IBM Verify Identity Access to execute arbitrary code, leading to potential system compromise.","exploitability":"Exploitation requires valid credentials and is relatively straightforward given the described vulnerability.","blast_radius":"If exploited, the attacker could gain full control over the affected system, leading to data theft, service disruption, and further lateral movement within the network.","remediation":"Upgrade to IBM Security Verify Access 10.0.9.3 or later, or IBM Verify Identity Access 11.0.4 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","auth","web","patch"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:43:30.699Z"}}