IBM Warns: Urgently Update Verify Access to Stop Critical Remote Login Bypass CVE-2026-19491

IBM has disclosed a critical authentication bypass vulnerability in its Security Verify Access and Verify Identity Access products. The flaw, tracked as CVE-2026-19491, allows remote attackers to circumvent login controls without valid credentials.

The vulnerability stems from improper authentication logic within the software. According to the National Vulnerability Database (NVD), the issue is classified under CWE-287, which denotes improper authentication. The NVD assigns the flaw a CVSS score of 9.1, placing it in the critical severity range. This high score reflects the ease with which an attacker can exploit the issue from a remote location and the severe impact on system confidentiality and integrity.

Context and Background

Authentication systems serve as the primary gatekeeper for enterprise applications. When this gate fails, attackers can gain unauthorized access to sensitive data, administrative interfaces, and backend services. In this specific case, the improper handling of authentication requests means that the system may grant access to users who have not successfully proven their identity.

This type of vulnerability is particularly dangerous because it does not require complex exploitation techniques. An attacker does not need to find a second vulnerability or perform social engineering to gain entry. If the authentication mechanism is bypassed, the attacker effectively walks through the front door. For small-business owners and IT managers, this represents a direct threat to the security posture of any application protected by these IBM products.

Who Is Affected

The vulnerability impacts specific versions of IBM’s identity and access management suite. IBM Security Verify Access versions 10.0 through 10.0.9.2 are affected. This also includes the containerized version, IBM Security Verify Access Container, up to version 10.0.9.2.

Additionally, IBM Verify Identity Access versions 11.0 through 11.0.3 are vulnerable. The containerized variant, IBM Verify Identity Access Container, is also affected up to version 11.0.3. Organizations running any of these versions must assume their systems are exposed until they can verify the status of their installations.

What to watch

Security teams should immediately audit their environments to identify any instances of the affected IBM products. Inventory checks should focus on version numbers to determine if systems fall within the vulnerable ranges. Since the flaw allows for remote exploitation, the risk is elevated for any instance exposed to the internet or untrusted networks.

Monitor network logs for unusual authentication patterns or successful logins from unexpected sources. Look for spikes in traffic to login endpoints that do not correspond with normal user activity. If an organization has not yet received a patch, they should consider isolating affected systems from public networks to reduce the attack surface.

What to do and how to stay safe: IBM

• Inventory all instances of IBM Security Verify Access and IBM Verify Identity Access to check version numbers against the affected ranges.
• Restrict network access to the authentication servers, limiting connections to trusted internal IP addresses if possible.
• Monitor system logs for signs of unauthorized access or repeated failed authentication attempts that may indicate exploitation.
• Contact your IBM support representative to inquire about the availability of a patch or temporary mitigation steps.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-19491?

The CVSS score is 9.1, which is rated as critical.

Which IBM products are affected by this vulnerability?

IBM Security Verify Access up to 10.0.9.2 and IBM Verify Identity Access up to 11.0.3, including their container versions.

Is there a patch available for this vulnerability?

The source material does not confirm the availability of a patch or fix.