CVE-2026-1343: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

CVE-2026-1343 is a Server-Side Request Forgery (SSRF) vulnerability affecting multiple IBM identity and access management products. It allows unauthenticated remote attackers to bypass Reverse Proxy protections and directly contact internal authentication endpoints. Affected products include IBM Verify Identity Access Container 11.0–11.0.2, IBM Security Verify Access Container 10.0–10.0.9.1, IBM Verify Identity Access 11.0–11.0.2, and IBM Security Verify Access 10.0–10.0.9.1. The vulnerability was published on April 8, 2026, with a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, IBM Advisory).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery), where the affected IBM products fail to sufficiently validate or restrict outbound requests, allowing an attacker to reach internal authentication endpoints that are intended to be shielded by the Reverse Proxy component. Exploitation requires no authentication, no user interaction, and only network access, making it trivially accessible to any remote attacker. The changed scope (S:C) in the CVSS vector indicates that a successful attack can impact resources beyond the vulnerable component itself — specifically, internal authentication infrastructure. No public proof-of-concept exploit code has been identified at this time (GitHub Advisory, IBM Advisory).

Successful exploitation allows an unauthenticated attacker to bypass the Reverse Proxy and interact directly with internal authentication endpoints, potentially exposing sensitive authentication system data and enabling unauthorized modification of authentication configurations. The confidentiality and integrity impacts are rated Low, but the changed scope means the attack can affect components beyond the directly vulnerable service. This could facilitate credential harvesting, authentication bypass, or serve as a pivot point for deeper access into protected internal systems (GitHub Advisory, IBM Advisory).

1. Reconnaissance: Identify internet-facing IBM Verify Identity Access or IBM Security Verify Access deployments (versions 10.0–10.0.9.1 or 11.0–11.0.2) using network scanning tools such as Shodan or Censys, targeting known service banners or login pages.
2. Identify SSRF entry point: Locate input fields or API parameters within the application that accept URLs or endpoint references and are processed server-side — these are the vectors through which SSRF payloads can be injected.
3. Craft SSRF payload: Construct a request that references internal authentication endpoints (e.g., http://127.0.0.1:<port>/internal-auth-endpoint) that are normally protected by the Reverse Proxy, embedding this in the vulnerable parameter.
4. Bypass Reverse Proxy: Submit the crafted request to the vulnerable IBM product; the server processes the request internally, bypassing the Reverse Proxy's access controls and forwarding the request to the internal endpoint.
5. Interact with internal authentication systems: Use the SSRF channel to enumerate, query, or manipulate internal authentication endpoints, potentially extracting session tokens, credentials, or configuration data (GitHub Advisory).

• Network: Unusual outbound or loopback requests originating from the IBM Verify/Security Verify Access application server to internal authentication endpoints; unexpected HTTP requests to internal IP ranges (127.0.0.1, 10.x.x.x, 172.16.x.x, 192.168.x.x) from the application process.
• Logs: Application or proxy logs showing requests to internal authentication endpoints that do not correspond to legitimate user sessions; repeated or automated requests to internal service URLs from external source IPs.
• Process/Application: Anomalous API calls or responses from internal authentication services not initiated by known administrative activity; error messages in application logs referencing unexpected internal endpoint access attempts.

IBM has released patches for all affected product lines; organizations should update IBM Verify Identity Access and IBM Verify Identity Access Container to versions beyond 11.0.2, and IBM Security Verify Access and IBM Security Verify Access Container to versions beyond 10.0.9.1. As an interim workaround, implement network segmentation to restrict access to internal authentication endpoints so they are not reachable even via SSRF. Additionally, monitor for suspicious requests attempting to contact internal endpoints through the Reverse Proxy (IBM Advisory, IBM Support).

The vulnerability received coverage from several cybersecurity news outlets including GBHackers, CyberSecurityNews, and CyberPress, which highlighted the risk of remote attackers accessing sensitive authentication data (GBHackers, CyberSecurityNews). CISA included the CVE in its weekly vulnerability summary bulletin for the week of April 6, 2026 (CISA Bulletin). Social media activity was limited to automated CVE tracking accounts on Mastodon and Bluesky, with no notable researcher commentary or significant community debate observed.