Arbitrary Command Execution in IBM Verify Access 10.0-10.0.9.2, 11.0-11.0.3
CVE-2026-19482 Published on October 8, 2026
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments.
Vulnerability Analysis
CVE-2026-19482 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is an Argument Injection Vulnerability?
The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CVE-2026-19482 has been classified to as an Argument Injection vulnerability or weakness.
Products Associated with CVE-2026-19482
Want to know whenever a new CVE is published for IBM products? stack.watch will email you.
Affected Versions
IBM Security Verify Access:- Version 10.0, <= 10.0.9.2 is affected.
- Version 11.0, <= 11.0.3 is affected.
- Version 10.0, <= 10.0.9.2 is affected.
- Version 11.0, <= 11.0.3 is affected.