CVE-2026-17189

Summary

A cross-site scripting vulnerability in IBM Security Verify Access and Verify Identity Access allows unauthenticated attackers to inject malicious JavaScript into the web interface, potentially leading to credential theft during trusted sessions.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and only needs a user to visit a crafted URL, though it may require social engineering to get users to interact with the malicious page.

Blast radius

The vulnerability could impact a large number of users who access the affected IBM security platforms, potentially leading to widespread credential compromise within trusted sessions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM Security Verify Access 10.0.9.3 or later, or IBM Verify Identity Access 11.0.4 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.