Vendor scorecard
IBM Security Identity
IBM Security Identity security disclosure record — CVE volume, CVSS severity mix and product-category breakdown, sourced from the NIST NVD.
CPE: ibm
Product families
1
Open in latest
106
Inferred — see methodology
Last disclosure
Oct 8, 2026
01
Product categories
1 trackedCVE volume, severity mix and the inferred latest shipping version per category.
| Category | CVEs | Volume | Severity mix | Open | Inferred latest |
|---|---|---|---|---|---|
| Security Verify / Access ManagerIdentity & Access Managementsecurity_verify_access, security_access_manager, security_identity_manager… | 62 | 106 | 7.0.1.10MED |
Each count is distinct CVEs within that category. A CVE affecting more than one category is counted in each, so these can sum to more than the IBM Security Identity total above.
02
Disclosure trend
12 monthsCumulative CVEs published on or before each month-end over the last 12 months, stacked by CVSS severity. A fixed 12-month window — independent of the date filter above.
- Critical
- High
- Medium
- Low
03
Recent CVEs
12 shownMost recently published, newest first. Each ID links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-78407(opens NVD record) | Medium | 5.4 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | Oct 8, 2026 |
| CVE-2026-78406(opens NVD record) | Critical | 9.8 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data. | Oct 8, 2026 |
| CVE-2026-78401(opens NVD record) | Critical | 9.8 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data. | Oct 8, 2026 |
| CVE-2026-78399(opens NVD record) | Medium | 6.5 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources | Oct 8, 2026 |
| CVE-2026-78388(opens NVD record) | Medium | 4.3 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | Oct 8, 2026 |
| CVE-2026-19878(opens NVD record) | Medium | 6.5 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass additional authentication workflow steps. | Oct 8, 2026 |
| CVE-2026-19498(opens NVD record) | Medium | 5.9 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a denial of service due to uncontrolled recursion. | Oct 8, 2026 |
| CVE-2026-19494(opens NVD record) | High | 8.1 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. | Oct 8, 2026 |
| CVE-2026-19493(opens NVD record) | High | 7.5 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to perform an arbitrary file write due to path traversal. | Oct 8, 2026 |
| CVE-2026-19491(opens NVD record) | Critical | 9.1 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication. | Oct 8, 2026 |
| CVE-2026-19482(opens NVD record) | High | 8.8 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments. | Oct 8, 2026 |
| CVE-2026-18740(opens NVD record) | High | 8.8 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to perform unauthorized actions due to argument injection. | Oct 8, 2026 |
62 CVEs · 1 product families