CVE-2026-12005: ibm security verify access OS Command Injection
Vulnerability summary
CVE-2026-12005 is a high (CVSS 7.2) OS Command Injection vulnerability in ibm security verify access. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.3% of scored vulnerabilities.
Timeline
- 12-08-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional operations by crafting a malicious HTTP request.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
+0.17 pp
From 0.37% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ibm4 products
- security verify access≥ 10.0, ≤ 10.0.9.2 | ≥ 10.0.0, ≤ 10.0.9.2 | 10.0.9.2:interim_fix1
- security_verify_access_container≥ 10.0, ≤ 10.0.9.2
- verify identity access≥ 11.0, ≤ 11.0.3
- verify_identity_access_container≥ 11.0, ≤ 11.0.3 | ≥ 11.0.0.0, ≤ 11.0.3.0
1 vendor · 4 products