Medium severity · published Apr 1, 2026
CVE-2026-4364
Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
5.4
CVSS
0.1%
EPSS
No
On KEV
Description
IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 allows certificate listings retrieved via a browser session to return a JSON payload while incorrectly specifying the response Content-Type as text/html. Because the content is delivered with an HTML MIME type, browsers may interpret the JSON data as executable script under certain conditions. This creates an opportunity for JavaScript injection, potentially leading to cross-site scripting (XSS).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SV
Security Verify Access · IBM
10.0 through 10.0.9.1 · source: vendor, NVD
SV
Security Verify Access Container · IBM
10.0 through 10.0.9.1 · source: vendor, NVD
VI
Verify Identity Access · IBM
11.0 through 11.0.2 · source: vendor, NVD
VI
Verify Identity Access Container · IBM
11.0 through 11.0.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4364
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4364
Vendor Advisory
https://www.ibm.com/support/pages/node/7268253
More from Security Verify Access
10.0
CVE-2024-28787
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote attacker to obtain highly sensitive private information or…
9.8
CVE-2026-78401
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
9.8
CVE-2026-78406
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
9.8
CVE-2026-11928
Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
9.8
CVE-2026-17616
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access