CVE-2026-8639

Summary

IBM Security Verify Directory and IBM Verify Directory are vulnerable to session fixation (CWE-384), allowing an attacker with low privileges to fix a session ID before a victim authenticates, then hijack the authenticated session to gain unauthorized access to the directory management console.

Exploitability

Exploitation requires the attacker to have low-privilege network access (PR:L) and ability to interact with the authentication flow (e.g., via phishing or social engineering), but no user interaction is needed beyond initial victim engagement.

Blast radius

Successful exploitation grants full confidentiality, integrity, and availability impact within the directory management console, enabling full compromise of directory configuration, user data, and administrative functions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade IBM Security Verify Directory to 10.0.5 or later, or IBM Verify Directory to a version that includes the fix for CVE-2026-8639; if no fixed version is yet published for your specific branch, apply vendor-recommended session management hardening (e.g., regenerate session IDs on authentication success and enforce strict session binding).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.