CVE-2026-8639

Full vulnerability record from the local CVENow database.

Description

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console.

Severity

HIGH

CVSS score

8.8 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-11-08 19:17:42.573000

Last modified

2026-11-08 19:17:42.693000

View original CVE JSON

{
  "id": "CVE-2026-8639",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-08T19:17:42.573",
  "lastModified": "2026-11-08T19:17:42.693",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "IBM",
          "product": "Security Verify Directory",
          "cpes": [
            "cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_directory:10.0.4:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "10.0.0",
              "lessThanOrEqual": "10.0.4",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "IBM",
          "product": "Verify Directory",
          "cpes": [
            "cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "11.0.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-384"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7293828",
      "source": "[email protected]"
    }
  ]
}