CVE-2026-12004
Full vulnerability record from the local CVENow database.
Description
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request.
Severity
HIGH
CVSS score
8.7
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-12 20:17:33.530000
Last modified
2026-10-23 19:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-12004",
"sourceIdentifier": "[email protected]",
"published": "2026-08-12T20:17:33.530",
"lastModified": "2026-10-23T19:10:00.167",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request."
},
{
"lang": "es",
"value": "IBM Security Verify Access 10.0 hasta 10.0.9.2 y IBM Verify Identity Access 11.0 hasta 11.0.3 y IBM Verify Identity Access Contenedor 11.0 hasta 11.0.3 contiene una vulnerabilidad de inyección de cadena de formato en la interfaz de gestión que permite a los atacantes causar denegación de servicio y revelación de información mediante la creación de una solicitud HTTP maliciosa."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "IBM",
"product": "Security Verify Access",
"cpes": [
"cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "10.0",
"lessThanOrEqual": "10.0.9.2",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "IBM",
"product": "Verify Identity Access",
"cpes": [
"cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "11.0",
"lessThanOrEqual": "11.0.3",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "IBM",
"product": "Verify Identity Access Container",
"cpes": [
"cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:verify_identity_access_container:11.0.3:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "11.0",
"lessThanOrEqual": "11.0.3",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "IBM",
"product": "Security Verify Access Container",
"cpes": [
"cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:security_verify_access_container:10.0.9.2:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "10.0",
"lessThanOrEqual": "10.0.9.2",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.3,
"impactScore": 5.8
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-13T14:15:13.629194Z",
"id": "CVE-2026-12004",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-134"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.0.0",
"versionEndIncluding": "10.0.9.2",
"matchCriteriaId": "7B471197-37E5-4B7D-AF9E-0F9A3EEA4B6B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.9.2:interim_fix1:*:*:*:*:*:*",
"matchCriteriaId": "D58DD2C2-F5CA-4A10-933B-4CB149CEB811"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.0",
"versionEndIncluding": "11.0.3",
"matchCriteriaId": "5899B235-F061-4026-A0C1-AB506035D604"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:verify_identity_access_container:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.0.0.0",
"versionEndIncluding": "11.0.3.0",
"matchCriteriaId": "A25819B9-7101-415B-93F8-27FB72BA5C3D"
}
]
}
]
}
],
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7283079",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}