{"id":"CVE-2026-18740","published":"2026-10-08T21:17:56.777","lastModified":"2026-10-10T04:18:12.470","description":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to perform unauthorized actions due to argument injection.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-88"],"vendors":["ibm"],"products":["security verify access","security verify access container","verify identity access","verify identity access container"],"references":[{"url":"https://www.ibm.com/support/pages/node/7291628","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows a remote authenticated attacker to perform unauthorized actions due to argument injection, which can lead to significant security breaches.","exploitability":"Exploitation requires a valid login and the ability to inject arguments, making it moderately difficult.","blast_radius":"If exploited, this could result in unauthorized access and potential data compromise for affected users.","remediation":"Upgrade to IBM Security Verify Access 10.0.10 or later, or IBM Verify Identity Access 11.0.4 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","argument-injection","web","remote","unauthorized-access"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:43:58.737Z"}}