IBM Security Verify Access Critical Auth Bypass Flaw CVE-2026-16823 Lacks Patch

IBM has disclosed a critical authentication bypass vulnerability affecting its Security Verify Access and Verify Identity Access products. The flaw, tracked as CVE-2026-16823, allows remote attackers to circumvent security controls due to improper authentication handling.

What happened

According to the National Vulnerability Database (NVD), the issue stems from CWE-287, which relates to improper authentication mechanisms. This weakness enables a remote attacker to bypass security restrictions entirely. The vulnerability impacts specific version ranges of IBM’s identity management solutions. Affected software includes IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3.

The containerised variants of these products are also vulnerable, with IBM Security Verify Access Container up to 10.0.9.2 and IBM Verify Identity Access Container up to 11.0.3 included in the scope. The NVD record assigns a CVSS score of 9.1, classifying the severity as critical. This high score reflects the ease with which an attacker can exploit the flaw remotely without requiring prior authentication or user interaction. The improper authentication logic fails to adequately validate requests, thereby granting unauthorised access to protected resources.

Why it matters

Identity management systems are central to enterprise security architectures, often serving as the gatekeeper for sensitive data and applications. A bypass in this layer effectively neutralises perimeter defences, allowing attackers to move laterally within a network. For CISOs and IT managers, the critical rating indicates an immediate risk to infrastructure integrity.

The widespread adoption of IBM’s Verify products in large organisations amplifies the potential impact of this vulnerability. Without proper mitigation, organisations risk unauthorised data exfiltration and system compromise. The absence of a confirmed patch in the source material means that exposure remains high for all affected versions.

Next steps

• Audit current installations to identify if versions 10.0 through 10.0.9.2 or 11.0 through 11.0.3 are in use.
• Monitor network traffic for anomalous authentication patterns or unauthorised access attempts.
• Review access logs for signs of exploitation related to improper authentication events.
• Prepare for an update once the vendor provides a confirmed fix for CVE-2026-16823.

What to do and how to stay safe: IBM

• Restrict network access to identity management servers to authorised administrative IPs only.
• Enable enhanced logging on authentication services to detect bypass attempts.
• Implement additional monitoring rules for unexpected privilege escalations.
• Review firewall configurations to limit exposure of affected services to untrusted networks.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which IBM products are affected by CVE-2026-16823?

IBM Security Verify Access up to 10.0.9.2 and IBM Verify Identity Access up to 11.0.3, including their container versions, are affected.

What is the severity of this vulnerability?

The NVD rates CVE-2026-16823 as critical with a CVSS score of 9.1.

Is there a patch available for this issue?

No fix has been confirmed yet; users should wait for the vendor to provide an update.