CVE-2026-78399: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

CVE-2026-78399 is a denial-of-service vulnerability in IBM Security Verify Access and IBM Verify Identity Access caused by improper allocation of system resources (CWE-770). An authenticated remote attacker can send a specially crafted HTTP query to exhaust system resources and render the service unavailable. Affected products include IBM Security Verify Access 10.0 through 10.0.9.2 (and container variants), and IBM Verify Identity Access 11.0 through 11.0.3 (and container variants). The vulnerability was published on October 8, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, IBM Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the affected IBM products fail to impose adequate restrictions on the size or number of resources allocated when processing HTTP queries. An authenticated attacker with low privileges can submit a specially crafted HTTP request over the network that triggers unbounded resource consumption — such as memory or processing capacity — leading to service degradation or crash. No user interaction is required beyond authentication, and attack complexity is low. No public technical write-ups or proof-of-concept code have been identified at this time (GitHub Advisory, IBM Advisory).

Successful exploitation results in a denial-of-service condition, making the IBM Security Verify Access or IBM Verify Identity Access service unavailable to legitimate users. The impact is limited to availability — there is no confidentiality or integrity impact, and the scope is unchanged, meaning the attack does not propagate beyond the targeted component. Given that these products serve as identity and access management platforms, a sustained DoS attack could disrupt authentication services for dependent applications and users across an organization (GitHub Advisory, IBM Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code for CVE-2026-78399 (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.265%, placing it in the 18th percentile for exploitation likelihood within 30 days. Exploitation requires authentication (low privileges), which reduces the overall risk compared to unauthenticated vulnerabilities. No threat actor attribution has been reported.

IBM has released patched versions addressing this vulnerability. Organizations should upgrade IBM Security Verify Access to version 10.0.9.3 or later, and IBM Verify Identity Access to version 11.0.3.1 or later (IBM Advisory). As interim mitigations, restrict network access to the affected systems to only trusted, authenticated users, and implement rate limiting or HTTP request throttling at the network or application layer to detect and block abnormally large or malformed queries. Container deployments (Security Verify Access Container and Verify Identity Access Container) are also affected and should be updated accordingly.

Heise Online published a news article noting that attackers can impact systems running IBM Verify Identity Access, contributing to broader coverage of the vulnerability batch affecting IBM's identity products (Heise). A community roundup at CyberUpdates365 highlighted this CVE as part of a broader set of 22 vulnerabilities affecting IBM Verify Access products (CyberUpdates365). No significant researcher commentary or social media debate has been observed beyond standard vulnerability tracking and aggregation sites.