« Volver al listado

CVE-2026-4938

Estado: AnalizadaMedia (6.5)—

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow an attacker with read-only privileges to make unauthorized modifications and deployments outside of their assigned permissions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

IBM — Security Verify AccessIBM — Security Verify Access ContainerIBM — Verify Identity AccessIBM — Verify Identity Access Container

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-4938",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-4938",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-20T19:18:00.995017Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:verify_identity_access:11.0.2:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Verify Identity Access",
          "versions": [
            {
              "status": "affected",
              "version": "11.0",
              "versionType": "semver",
              "lessThanOrEqual": "11.0.2"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access:10.0.9.1:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Security Verify Access",
          "versions": [
            {
              "status": "affected",
              "version": "10.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.0.9.1"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:verify_identity_access_container:11.0.2:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Verify Identity Access Container",
          "versions": [
            {
              "status": "affected",
              "version": "11.0",
              "versionType": "semver",
              "lessThanOrEqual": "11.0.2"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_verify_access_container:10.0.9.1:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Security Verify Access Container",
          "versions": [
            {
              "status": "affected",
              "version": "10.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.0.9.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-07-17T20:17:23.410",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7279510",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow an attacker with read-only privileges to make unauthorized modifications and deployments outside of their assigned permissions."
    }
  ],
  "lastModified": "2026-07-30T13:07:59.197",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C71B5C3B-4B1F-4330-9260-26B349CAE490",
              "versionEndIncluding": "10.0.9.1",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access_container:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "674B3E72-09DE-48D4-9F07-43152474E8CD",
              "versionEndIncluding": "10.0.9.1",
              "versionStartIncluding": "10.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0423E539-1149-47AB-9A74-8E8387343FE2",
              "versionEndIncluding": "11.0.2.0",
              "versionStartIncluding": "11.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:verify_identity_access_container:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3FDCBF44-E483-4248-A39E-CB9226FF4BC9",
              "versionEndIncluding": "11.0.2.0",
              "versionStartIncluding": "11.0.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}