{"id":"CVE-2026-17189","published":"2026-10-08T21:17:56.633","lastModified":"2026-10-13T14:17:36.777","description":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79"],"vendors":["ibm"],"products":["security verify access","security verify access container","verify identity access","verify identity access container"],"references":[{"url":"https://www.ibm.com/support/pages/node/7291628","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A cross-site scripting vulnerability in IBM Security Verify Access and Verify Identity Access allows unauthenticated attackers to inject malicious JavaScript into the web interface, potentially leading to credential theft during trusted sessions.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and only needs a user to visit a crafted URL, though it may require social engineering to get users to interact with the malicious page.","blast_radius":"The vulnerability could impact a large number of users who access the affected IBM security platforms, potentially leading to widespread credential compromise within trusted sessions.","remediation":"Upgrade to IBM Security Verify Access 10.0.9.3 or later, or IBM Verify Identity Access 11.0.4 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","web","credential-theft","session"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:57:05.645Z"}}