Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-8861: IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical er

32
Routine
MEDIUM 5.3REMOTEUPGRADEUPGRADEUPGRADE

CVE-2026-8861 is a medium-severity flaw (CVSS 5.3) affecting security verify access, security verify access container, verify identity access. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.

Why this priority

  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score5.3 (Medium)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance0.4% (top 66%)
CISA exploited listNo
WeaknessCWE-209
Published2026-07-17
Last modified2026-08-11
Publisher (CNA): IBM Corporation · Vendor: ibm

Share: LinkedIn · X · Reddit

Last updated 2026-08-11 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

ibm security verify access UPGRADE
Affected: >= 10.0.0 and < 10.0.9.2
Fixed in: 10.0.9.2
Safe to downgrade to: a release before 10.0.0
1. Check installed version
apt-cache policy security-verify-access || rpm -q security-verify-access || security-verify-access --version
2. UPGRADE to 10.0.9.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade security-verify-access
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade security-verify-access
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 10.0.0 (Debian / Ubuntu)
apt-cache madison security-verify-access sudo apt install security-verify-access=<VERSION_BEFORE_10.0.0> sudo apt-mark hold security-verify-access
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list security-verify-access sudo dnf downgrade security-verify-access-<VERSION_BEFORE_10.0.0> sudo dnf versionlock add security-verify-access
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
ibm security verify access container UPGRADE
Affected: >= 10.0.0.0 and <= 10.0.9.1
Fixed in: newer than 10.0.9.1
Safe to downgrade to: a release before 10.0.0.0
1. Check installed version
apt-cache policy security-verify-access-container || rpm -q security-verify-access-container || security-verify-access-container --version
2. UPGRADE to newer than 10.0.9.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade security-verify-access-container
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade security-verify-access-container
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 10.0.0.0 (Debian / Ubuntu)
apt-cache madison security-verify-access-container sudo apt install security-verify-access-container=<VERSION_BEFORE_10.0.0.0> sudo apt-mark hold security-verify-access-container
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list security-verify-access-container sudo dnf downgrade security-verify-access-container-<VERSION_BEFORE_10.0.0.0> sudo dnf versionlock add security-verify-access-container
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
ibm verify identity access UPGRADE
Affected: >= 11.0 and < 11.0.3
Fixed in: 11.0.3
Safe to downgrade to: a release before 11.0
1. Check installed version
apt-cache policy verify-identity-access || rpm -q verify-identity-access || verify-identity-access --version
2. UPGRADE to 11.0.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade verify-identity-access
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade verify-identity-access
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 11.0 (Debian / Ubuntu)
apt-cache madison verify-identity-access sudo apt install verify-identity-access=<VERSION_BEFORE_11.0> sudo apt-mark hold verify-identity-access
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list verify-identity-access sudo dnf downgrade verify-identity-access-<VERSION_BEFORE_11.0> sudo dnf versionlock add verify-identity-access
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
ibm verify identity access container UPGRADE
Affected: >= 11.0.0.0 and <= 11.0.2
Fixed in: newer than 11.0.2
Safe to downgrade to: a release before 11.0.0.0
1. Check installed version
apt-cache policy verify-identity-access-container || rpm -q verify-identity-access-container || verify-identity-access-container --version
2. UPGRADE to newer than 11.0.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade verify-identity-access-container
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade verify-identity-access-container
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 11.0.0.0 (Debian / Ubuntu)
apt-cache madison verify-identity-access-container sudo apt install verify-identity-access-container=<VERSION_BEFORE_11.0.0.0> sudo apt-mark hold verify-identity-access-container
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list verify-identity-access-container sudo dnf downgrade verify-identity-access-container-<VERSION_BEFORE_11.0.0.0> sudo dnf versionlock add verify-identity-access-container
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-8861?

security verify access: upgrade to 10.0.9.2; security verify access container: upgrade to newer than 10.0.9.1; verify identity access: upgrade to 11.0.3. Exact commands for each OS are on this page.

Is CVE-2026-8861 being exploited?

CVE-2026-8861 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-8861 affect?

CVE-2026-8861 affects security verify access, security verify access container, verify identity access. Severity is medium (CVSS 5.3). IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.

How urgent is CVE-2026-8861?

Priority 32/100. Remotely exploitable, no login, no user action

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.