CVE-2026-78406: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

CVE-2026-78406 is a critical deserialization of untrusted data vulnerability in IBM Security Verify Access and IBM Verify Identity Access that allows remote unauthenticated attackers to execute arbitrary code. It affects IBM Security Verify Access versions 10.0 through 10.0.9.2 (including container variants) and IBM Verify Identity Access versions 11.0 through 11.0.3 (including container variants). The vulnerability was published on October 8, 2026, with patches made available the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, IBM Advisory).

The root cause is improper deserialization of untrusted data (CWE-502), mapped to CAPEC-586 (Object Injection). An attacker can send a crafted network request containing a malicious serialized payload to the affected IBM Verify Access service; when the application deserializes this input without adequate validation, it triggers arbitrary code execution. No authentication is required, and the attack complexity is low, making it trivially automatable over the network. No specific technical write-up or public PoC code has been identified at this time (GitHub Advisory, IBM Advisory).

Successful exploitation grants an unauthenticated remote attacker full code execution on the affected system with the privileges of the application process, resulting in high confidentiality, integrity, and availability impact. Because IBM Security Verify Access and Verify Identity Access are identity and access management platforms, compromise could expose authentication credentials, session tokens, and user identity data for all integrated applications, and could enable lateral movement across the enterprise. The NVD SSVC assessment classifies the technical impact as "total," reflecting the potential for complete system takeover (GitHub Advisory, IBM Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment notes the vulnerability is automatable with no evidence of active exploitation. The EPSS score is approximately 0.499% (41st percentile), indicating a relatively low near-term exploitation probability despite the critical severity. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify internet-facing IBM Security Verify Access or Verify Identity Access instances using tools like Shodan or Censys, targeting versions 10.0–10.0.9.2 or 11.0–11.0.3.
2. Identify deserialization endpoint: Determine the network-accessible endpoint(s) that accept serialized data (e.g., Java serialized objects or similar formats) without authentication.
3. Craft malicious payload: Using a tool such as ysoserial, generate a serialized payload targeting a known gadget chain compatible with the application's Java runtime or libraries.
4. Deliver payload: Send the crafted serialized object to the vulnerable endpoint via an HTTP/HTTPS request or other supported protocol, with no authentication headers required.
5. Achieve code execution: The server deserializes the malicious object, triggering the gadget chain and executing attacker-controlled commands with the privileges of the Verify Access application process (e.g., establishing a reverse shell or dropping a web shell for persistent access).

• Network: Unexpected or anomalous POST requests to IBM Verify Access service endpoints from external or untrusted IP addresses; outbound connections from the Verify Access server to unknown external hosts (potential reverse shell or C2 traffic).
• Logs: Application or access logs showing requests with unusually large or binary-encoded payloads to authentication/identity service endpoints; Java deserialization-related exceptions or stack traces in server logs.
• Process: Unusual child processes spawned by the IBM Verify Access Java process (e.g., sh, bash, cmd.exe, curl, wget, python); unexpected network listeners opened by the application process.
• File System: New or modified files in the Verify Access installation or web root directories, particularly scripts or executables not part of the standard installation; new cron jobs or scheduled tasks created under the service account.

IBM has released patched versions addressing this vulnerability: update IBM Security Verify Access to version 10.0.9.3 or later, and IBM Verify Identity Access to version 11.0.3.1 or later (IBM Advisory). As interim mitigations, restrict network access to Verify Access services from untrusted networks using firewall rules or network segmentation. Consider deploying Web Application Firewall (WAF) rules to detect and block malicious deserialization payloads targeting these services. Upgrading to the patched version is the recommended and definitive remediation.

Media coverage highlighted this vulnerability as part of a broader IBM patch release addressing 22 vulnerabilities in Verify Access products, with outlets such as CyberSecurityNews, The Daily Tech Feed, and Cryptika reporting on the critical RCE risk (CyberSecurityNews, Cryptika). German technology outlet Heise reported that attackers could take over systems via the IBM Verify Identity Access flaw (Heise). ThreatAft published analysis grouping CVE-2026-78406 with related IBM Verify Access deserialization issues (ThreatAft). Social media discussion was noted on Bluesky and Mastodon/Infosec.exchange, reflecting moderate community interest given the critical CVSS score and the identity management context of the affected products.