CVE-2026-78401: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

CVE-2026-78401 is a critical deserialization of untrusted data vulnerability (CWE-502) affecting IBM Security Verify Access and IBM Verify Identity Access that allows a remote unauthenticated attacker to execute arbitrary code. Affected versions include IBM Security Verify Access 10.0 through 10.0.9.2 (and container variants) and IBM Verify Identity Access 11.0 through 11.0.3 (and container variants). The vulnerability was published on October 8, 2026, with patches made available the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, IBM Advisory).

The root cause is improper deserialization of untrusted data (CWE-502, mapped to CAPEC-586: Object Injection), where the application processes attacker-controlled serialized objects without adequate validation. An unauthenticated remote attacker can send a crafted network request containing a malicious serialized payload to a vulnerable endpoint, which the application deserializes and executes. No authentication, user interaction, or elevated privileges are required, and the attack complexity is low, making this trivially exploitable over the network (GitHub Advisory, IBM Advisory).

Successful exploitation grants an unauthenticated remote attacker arbitrary code execution with the privileges of the vulnerable IBM Verify Access application process, resulting in complete compromise of confidentiality, integrity, and availability. An attacker could exfiltrate sensitive identity and access management data, modify authentication configurations, disrupt access control services, or use the compromised system as a pivot point for lateral movement within the enterprise network. Both appliance and container deployments are affected, broadening the potential attack surface (GitHub Advisory, IBM Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation (Feedly). The NVD SSVC assessment classifies the vulnerability as automatable with total technical impact, indicating it could be reliably weaponized at scale. The EPSS score is approximately 0.567% (46th percentile), reflecting a moderate near-term exploitation probability. No threat actor attribution or CISA KEV catalog listing has been reported at this time (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible IBM Security Verify Access (versions 10.0–10.0.9.2) or IBM Verify Identity Access (versions 11.0–11.0.3) instances using tools such as Shodan, Censys, or targeted network scanning.
2. Identify vulnerable endpoint: Locate the service endpoint that accepts and processes serialized Java or other object data — typically exposed via HTTP/HTTPS on the management or authentication interface.
3. Craft malicious payload: Construct a serialized object payload using a deserialization exploitation framework (e.g., ysoserial for Java) with a gadget chain appropriate for the application's classpath, embedding a command such as a reverse shell or file write.
4. Deliver payload: Send the crafted serialized payload in an unauthenticated HTTP/HTTPS request to the vulnerable endpoint, with no authentication headers required.
5. Achieve code execution: The server deserializes the malicious object, triggering the gadget chain and executing the embedded command with the privileges of the IBM Verify Access process, enabling reverse shell establishment, credential harvesting, or further lateral movement (GitHub Advisory, IBM Advisory).

• Network: Unexpected or anomalous unauthenticated HTTP/HTTPS POST requests to IBM Verify Access management or authentication endpoints containing binary or base64-encoded serialized object data; outbound connections from the Verify Access host to unknown external IPs or C2 infrastructure.
• Logs: Application or web server access logs showing requests with unusual content-type headers (e.g., application/x-java-serialized-object) or large binary payloads to authentication endpoints; Java exception stack traces related to deserialization errors in application logs.
• Process: Unexpected child processes spawned by the IBM Verify Access Java process (e.g., /bin/bash, sh, curl, wget, python, nc); unusual process execution chains originating from the application server user account.
• File System: New or modified files in the IBM Verify Access installation or temporary directories, including web shells, scripts, or unexpected binaries; new cron jobs or scheduled tasks created under the application service account.

IBM has released patched versions addressing this vulnerability: upgrade IBM Security Verify Access to version 10.0.9.3 or later, and IBM Verify Identity Access to version 11.0.3.1 or later; container variants should also be updated to their respective fixed releases (IBM Advisory). Organizations should prioritize patching immediately given the unauthenticated, network-accessible nature of the vulnerability. As an interim measure, restrict network access to IBM Verify Access management and authentication interfaces using firewall rules or network segmentation to limit exposure to trusted networks only.

The vulnerability received broad coverage from security news outlets, with reports noting that IBM patched 22 vulnerabilities across its Verify Access product line simultaneously, including multiple critical remote code execution flaws (CyberSecurityNews, TheDailyTechFeed). German technology outlet Heise reported that attackers could take over systems via the IBM Verify Identity Access flaw (Heise). Security community discussion on Mastodon and Bluesky highlighted the critical severity and the lack of authentication required for exploitation (ThreatAft).