CVE-2026-12618: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

CVE-2026-12618 is an injection vulnerability (CWE-74) in IBM Security Verify Access and IBM Verify Identity Access that allows an authenticated administrator to execute commands beyond their entitled privileges due to improper validation of user-supplied input. It affects IBM Security Verify Access 10.0 through 10.0.9.2, IBM Verify Identity Access 11.0 through 11.0.3, and IBM Verify Identity Access Container 11.0 through 11.0.3. The vulnerability was published on August 12, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, IBM Support).

The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component — 'Injection'). The vulnerability arises because the affected IBM products fail to adequately validate or sanitize administrator-supplied input before passing it to a downstream component, enabling injection of additional commands. Exploitation requires network access with high privileges (an authenticated administrator account), no user interaction, and low attack complexity. No public proof-of-concept or detailed technical write-up has been identified at this time (GitHub Advisory, IBM Support).

Successful exploitation grants an authenticated administrator the ability to execute arbitrary commands beyond their authorized scope, resulting in high confidentiality, integrity, and availability impact on the affected system. This could allow an attacker with administrative access to exfiltrate sensitive identity and access management data, modify system configurations, or disrupt authentication services. Given that the affected products are identity and access management platforms, compromise could have downstream effects on all systems relying on them for authentication (GitHub Advisory, IBM Support).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit at this time. The NVD SSVC assessment also indicates no known exploitation. The EPSS score is approximately 0.37%, placing it in the 30th percentile for exploitation likelihood within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated administrator-level access, which limits the attack surface (GitHub Advisory, IBM Support).

IBM has released patches addressing this vulnerability. Users should upgrade to IBM Security Verify Access version 10.0.9.3 or later, or IBM Verify Identity Access (including the Container variant) version 11.0.4 or later. As interim measures, organizations should restrict administrator account access to trusted personnel only and monitor administrative command execution logs for anomalous activity. The patch details are available via the IBM support page and the GitHub Advisory (IBM Support, GitHub Advisory).