CVE-2026-13267: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

CVE-2026-13267 is a privilege escalation vulnerability affecting IBM Security Verify Access and IBM Verify Identity Access products. An authenticated user can gain the privileges of another user by sending a specially crafted network request. Affected products and versions include IBM Security Verify Access 10.0 through 10.0.9.2, IBM Verify Identity Access 11.0 through 11.0.3, and IBM Verify Identity Access Container 11.0 through 11.0.3. The vulnerability was published on August 12, 2026, and has a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, IBM Support).

The vulnerability is classified as CWE-302 (Authentication Bypass by Assumed-Immutable Data), meaning the authentication implementation relies on data elements assumed to be immutable but which can be controlled or modified by an attacker. An authenticated low-privileged user can craft a specially formed network request that manipulates these assumed-immutable data elements to impersonate another user and assume their access rights. No user interaction is required beyond the attacker's own authenticated session, and the attack is conducted entirely over the network with low complexity. No public technical write-up or proof-of-concept code has been identified at this time (GitHub Advisory, IBM Support).

Successful exploitation allows an authenticated attacker to impersonate any other user on the affected IBM identity and access management platform, resulting in high confidentiality and integrity impact. The attacker can gain unauthorized access to sensitive data and system functionality associated with the impersonated account, potentially including administrative capabilities. Availability is not directly impacted, but the ability to act as privileged users could enable further lateral movement or data exfiltration within environments relying on these products for access control (GitHub Advisory).

There is currently no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.248% (16th percentile), indicating a low near-term probability of exploitation. NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, requiring an authenticated session. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report.

IBM has released patches addressing this vulnerability; users should apply the security updates referenced in IBM Support page node/7283079 for IBM Security Verify Access (10.0–10.0.9.2) and IBM Verify Identity Access (11.0–11.0.3), including container deployments (IBM Support). As interim measures, organizations should restrict network access to affected systems, enforce strong authentication controls, and monitor for anomalous privilege escalation activity from authenticated accounts. Reviewing and auditing user session activity on these platforms is also recommended until patches are applied.