Can You Exploit CVE-2026-78401 to Run Code on IBM Verify Without Login?

IBM Security Verify Access and IBM Verify Identity Access contain a severe vulnerability that permits remote, unauthenticated attackers to execute arbitrary code on target systems. The issue arises from improper handling of data during the deserialization process, creating a direct path for system compromise.

Root cause

The underlying weakness is identified as CWE-502, which involves the deserialization of untrusted data. When the affected applications process incoming data streams, they fail to adequately validate the integrity or origin of the serialized objects before reconstructing them. This lack of validation allows an attacker to inject malicious payloads that the application executes as legitimate system commands. The National Vulnerability Database lists this specific flaw under CVE-2026-78401.

Attack path

An attacker does not need valid credentials to exploit this vulnerability. By sending crafted requests containing malicious serialized data to the affected services, the remote user can trigger the deserialization engine. Once the application processes this untrusted data, the arbitrary code executes on the host system. This grants the attacker full control over the compromised instance, potentially leading to data theft, lateral movement, or further infrastructure disruption.

Affected versions

The following products and version ranges are vulnerable to CVE-2026-78401:

• IBM Security Verify Access versions 10.0 through 10.0.9.2
• IBM Verify Identity Access versions 11.0 through 11.0.3
• IBM Security Verify Access Container versions 10.0 through 10.0.9.2
• IBM Verify Identity Access Container versions 11.0 through 11.0.3

Mitigation

• Verify current installed versions of IBM Security Verify Access and IBM Verify Identity Access against the affected ranges listed above.
• Restrict network access to these services to ensure they are not exposed to untrusted networks or the public internet.
• Monitor server logs for unusual deserialization errors or unexpected process executions that may indicate an exploitation attempt.
• Contact IBM support to inquire about the availability of patches or updates for the affected versions.

Background: Lateral movement

Lateral movement occurs when an attacker moves through a network after initial access. They steal credentials, map trusted connections, and pivot between systems to reach high-value targets. You can stop this by enforcing least privilege, segmenting networks, and monitoring for unusual internal traffic patterns that indicate unauthorized access.

Read the full guide: Lateral Movement Explained: Step-by-Step Attack Progression

What to do and how to stay safe: IBM

• Audit your inventory to identify any instances of IBM Security Verify Access or IBM Verify Identity Access running versions 10.0.9.2 or 11.0.3 and below.
• Implement network segmentation or firewall rules to limit access to these identity management components from untrusted zones.
• Enable detailed logging on the affected servers to detect anomalous traffic patterns or unauthorized code execution attempts.
• Once the vendor provides an update, apply it immediately to remediate the deserialization flaw.

Step-by-step guide: Patch Testing Best Practices That Prevent Production Failures

General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity rating for CVE-2026-78401?

The vulnerability has a CVSS score of 9.8, which is rated as critical.

Which specific IBM products are affected by this flaw?

IBM Security Verify Access and IBM Verify Identity Access, including their containerized versions, are affected.

Can an attacker exploit this without a password?

Yes, the vulnerability allows remote, unauthenticated attackers to execute arbitrary code.