{"id":"CVE-2026-8639","published":"2026-11-08T19:17:42.573","lastModified":"2026-11-09T05:18:33.967","description":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-384"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7293828","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Security Verify Directory and IBM Verify Directory are vulnerable to session fixation (CWE-384), allowing an attacker with low privileges to fix a session ID before a victim authenticates, then hijack the authenticated session to gain unauthorized access to the directory management console.","exploitability":"Exploitation requires the attacker to have low-privilege network access (PR:L) and ability to interact with the authentication flow (e.g., via phishing or social engineering), but no user interaction is needed beyond initial victim engagement.","blast_radius":"Successful exploitation grants full confidentiality, integrity, and availability impact within the directory management console, enabling full compromise of directory configuration, user data, and administrative functions.","remediation":"Upgrade IBM Security Verify Directory to 10.0.5 or later, or IBM Verify Directory to a version that includes the fix for CVE-2026-8639; if no fixed version is yet published for your specific branch, apply vendor-recommended session management hardening (e.g., regenerate session IDs on authentication success and enforce strict session binding).","detection":"No reliable host or network indicator is derivable from the published description.","tags":["session-fixation","auth-bypass","web","high-impact"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:47:25.757Z"}}