CVE-2026-12618: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

CVE-2026-12618 is an injection vulnerability (CWE-74) in IBM Security Verify Access and IBM Verify Identity Access that allows an authenticated administrator to execute commands beyond their entitled privileges due to improper validation of user-supplied input. It affects IBM Security Verify Access versions 10.0 through 10.0.9.2 (including 10.0.9.2-interim_fix1), IBM Verify Identity Access versions 11.0 through 11.0.3, and IBM Verify Identity Access Container versions 11.0 through 11.0.3. The vulnerability was published on August 12, 2026, with patches referenced in IBM's support portal. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, IBM Support).

The root cause is improper neutralization of special elements in output used by a downstream component (CWE-74), classified as an injection vulnerability. When an administrator submits crafted input through the product's administrative interface, the application fails to adequately validate or sanitize that input before passing it to a downstream component, allowing injection of additional commands. The attack vector is network-based, requires high privileges (administrator-level authentication), low attack complexity, and no user interaction. No public proof-of-concept or detailed technical write-up has been identified at this time (GitHub Advisory, IBM Support).

Successful exploitation allows an authenticated administrator to execute arbitrary commands beyond their entitled scope, resulting in high impact to confidentiality, integrity, and availability of the affected system. An attacker with administrative credentials could read sensitive identity and access management data, modify configurations or user records, and potentially disrupt service availability. Given that IBM Security Verify Access and Verify Identity Access serve as identity and access management platforms, compromise could facilitate lateral movement or privilege escalation across connected enterprise systems (GitHub Advisory, IBM Support).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.37%, indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and exploitation requires high-privilege (administrator) access, which limits the attack surface. The SSVC assessment notes the exploitation status as "none" (GitHub Advisory, IBM Support).

IBM has released patches addressing this vulnerability. Administrators should update IBM Security Verify Access to version 10.0.9.3 or later, and IBM Verify Identity Access (including the Container variant) to version 11.0.4 or later. As interim measures, organizations should restrict administrative account access to trusted personnel and networks, and monitor administrative command execution logs for anomalous activity. The patch details are available via the IBM support portal and the GitHub Advisory (IBM Support, GitHub Advisory).