CVE-2026-12359: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

CVE-2026-12359 is an authentication bypass vulnerability in IBM Security Verify Access and IBM Verify Identity Access products caused by inconsistent interpretation of HTTP requests by a reverse proxy. It affects IBM Security Verify Access versions 10.0 through 10.0.9.2 (including 10.0.9.2-interim_fix1), IBM Verify Identity Access versions 11.0 through 11.0.3, and IBM Verify Identity Access Container versions 11.0 through 11.0.3. The vulnerability was published on August 12, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, IBM Support).

The root cause is classified as CWE-287 (Improper Authentication), arising from an inconsistent interpretation of HTTP requests between the reverse proxy and backend server components — a pattern consistent with HTTP request smuggling. When the reverse proxy and backend server parse HTTP request boundaries differently (e.g., conflicting Content-Length and Transfer-Encoding headers), an attacker can craft ambiguous requests that bypass authentication controls enforced at the proxy layer. No authentication or user interaction is required, though exploitation complexity is rated High, indicating specific conditions or timing must be met. No public proof-of-concept code has been identified (GitHub Advisory, IBM Support).

Successful exploitation could allow an unauthenticated remote attacker to access sensitive information and potentially modify data by bypassing the authentication controls enforced by the IBM Security Verify Access reverse proxy. The CVSS scoring reflects high impacts across confidentiality, integrity, and availability, suggesting that a successful attack could result in full compromise of the affected identity and access management system. Given that IBM Security Verify Access serves as an identity gateway, compromise could enable unauthorized access to downstream protected resources and facilitate lateral movement within an enterprise environment (GitHub Advisory, IBM Support).

As of the time of disclosure, there is no evidence of active in-the-wild exploitation and no public proof-of-concept exploit has been identified (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.32–0.33%, indicating a low near-term probability of exploitation. The NVD SSVC assessment notes exploitation as "none" and the attack is not automatable, reflecting the High attack complexity rating.

IBM has released a patch addressing this vulnerability; administrators should apply the fix referenced in IBM Support page node/7283079 for the affected product lines. Organizations running IBM Security Verify Access 10.0–10.0.9.2 or IBM Verify Identity Access/Container 11.0–11.0.3 should prioritize upgrading to the patched versions. As interim mitigations, ensure consistent HTTP request parsing configurations between the reverse proxy and backend servers, implement request validation and filtering at the reverse proxy level, and monitor for suspicious HTTP requests with conflicting or ambiguous headers (IBM Support, GitHub Advisory).

Coverage of CVE-2026-12359 has been limited to automated vulnerability tracking platforms and aggregators such as VulDB, Offseq Radar, and exploit-intel.com, with no notable independent researcher commentary or significant media coverage identified. A brief mention appeared on Mastodon via RedPacketSecurity and on Bluesky via cyberhub.blog, consistent with routine vulnerability disclosure amplification rather than active community concern.