CVE-2026-5926

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5926", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-04-08T22:30:44.020Z", "datePublished": "2026-04-22T23:38:46.689Z", "dateUpdated": "2026-04-23T12:49:52.484Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-04-22T23:39:07.336Z"}, "title": "Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access", "affected": [{"vendor": "IBM", "product": "Verify Identity Access Container", "versions": [{"status": "affected", "version": "11.0", "lessThanOrEqual": "11.0.2", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access_container:11.0.2:*:*:*:*:*:*:*"]}, {"vendor": "IBM", "product": "Security Verify Access Container", "versions": [{"status": "affected", "version": "10.0", "lessThanOrEqual": "10.0.9.1", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access_container:10.0.9.1:*:*:*:*:*:*:*"]}, {"vendor": "IBM", "product": "Verify Identity Access", "versions": [{"status": "affected", "version": "11.0", "lessThanOrEqual": "11.0.2", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access:11.0.2:*:*:*:*:*:*:*"]}, {"vendor": "IBM", "product": "Security Verify Access", "versions": [{"status": "affected", "version": "10.0", "lessThanOrEqual": "10.0.9.1", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access:10.0.9.1:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7269372", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "IBM encourages customers to update their systems promptly.Appliance:Affected Products and VersionsFix availabilityIBM Verify Identity Access 11.0 - 11.0.2Download IBM Verify Identity Access v11.0.2 IF1IBM Security Verify Access 10.0.0 - 10.0.9.1Download IBM Security Verify Access v10.0.9.1 IF1Container:Container Download", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><strong>IBM encourages customers to update their systems promptly.</strong></p><p></p><p><strong>Appliance:</strong></p><div><table><thead><tr><td><p><strong>Affected Products and Versions</strong></p></td><td><p><strong>Fix availability</strong></p></td></tr><tr><td><p>IBM Verify Identity Access 11.0 - 11.0.2</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Security&amp;product=ibm/Tivoli/IBM+Verify+Identity+Access&amp;release=11.0.2.0&amp;platform=Linux&amp;function=fixId&amp;fixids=11.0.2.0-ISS-IVIA-IF0001+&amp;includeSupersedes=0\" rel=\"nofollow\">Download IBM Verify Identity Access v11.0.2 IF1</a></p></td></tr><tr><td><p>IBM Security Verify Access 10.0.0 - 10.0.9.1</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Security&amp;product=ibm/Tivoli/IBM+Security+Verify+Access&amp;release=10.0.9.1&amp;platform=Linux&amp;function=fixId&amp;fixids=10.0.9.1-ISS-ISVA-IF0001+&amp;includeSupersedes=0\" rel=\"nofollow\">Download IBM Security Verify Access v10.0.9.1 IF1</a></p></td></tr></thead></table></div><p></p><p><strong>Container:</strong></p><p><a href=\"https://docs.verify.ibm.com/ibm-security-verify-access/docs/containers\" rel=\"nofollow\">Container Download</a></p>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-327", "lang": "en", "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-23T12:49:48.620762Z", "id": "CVE-2026-5926", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T12:49:52.484Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access_container:11.0.2:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Verify Identity Access Container", "versions": [{"status": "affected", "version": "11.0", "versionType": "semver", "lessThanOrEqual": "11.0.2"}]}, {"cpes": ["cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access_container:10.0.9.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Security Verify Access Container", "versions": [{"status": "affected", "version": "10.0", "versionType": "semver", "lessThanOrEqual": "10.0.9.1"}]}, {"cpes": ["cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access:11.0.2:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Verify Identity Access", "versions": [{"status": "affected", "version": "11.0", "versionType": "semver", "lessThanOrEqual": "11.0.2"}]}, {"cpes": ["cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access:10.0.9.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Security Verify Access", "versions": [{"status": "affected", "version": "10.0", "versionType": "semver", "lessThanOrEqual": "10.0.9.1"}]}], "solutions": [{"lang": "en", "value": "IBM encourages customers to update their systems promptly.Appliance:Affected Products and VersionsFix availabilityIBM Verify Identity Access 11.0 - 11.0.2Download IBM Verify Identity Access v11.0.2 IF1IBM Security Verify Access 10.0.0 - 10.0.9.1Download IBM Security Verify Access v10.0.9.1 IF1Container:Container Download", "supportingMedia": [{"type": "text/html", "value": "<p><strong>IBM encourages customers to update their systems promptly.</strong></p><p></p><p><strong>Appliance:</strong></p><div><table><thead><tr><td><p><strong>Affected Products and Versions</strong></p></td><td><p><strong>Fix availability</strong></p></td></tr><tr><td><p>IBM Verify Identity Access 11.0 - 11.0.2</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Security&amp;product=ibm/Tivoli/IBM+Verify+Identity+Access&amp;release=11.0.2.0&amp;platform=Linux&amp;function=fixId&amp;fixids=11.0.2.0-ISS-IVIA-IF0001+&amp;includeSupersedes=0\" rel=\"nofollow\">Download IBM Verify Identity Access v11.0.2 IF1</a></p></td></tr><tr><td><p>IBM Security Verify Access 10.0.0 - 10.0.9.1</p></td><td><p><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Security&amp;product=ibm/Tivoli/IBM+Security+Verify+Access&amp;release=10.0.9.1&amp;platform=Linux&amp;function=fixId&amp;fixids=10.0.9.1-ISS-ISVA-IF0001+&amp;includeSupersedes=0\" rel=\"nofollow\">Download IBM Security Verify Access v10.0.9.1 IF1</a></p></td></tr></thead></table></div><p></p><p><strong>Container:</strong></p><p><a href=\"https://docs.verify.ibm.com/ibm-security-verify-access/docs/containers\" rel=\"nofollow\">Container Download</a></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7269372", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.</p>", "base64": false}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-04-22T23:39:07.336Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5926", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T12:49:48.620762Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-327", "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm"}]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-23T12:49:44.037Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-5926", "state": "PUBLISHED", "dateUpdated": "2026-04-22T23:39:07.336Z", "dateReserved": "2026-04-08T22:30:44.020Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-04-22T23:38:46.689Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access_container:11.0.2:*:*:*:*:*:*:*"], "product": "Verify Identity Access Container", "vendor": "IBM", "versions": [{"lessThanOrEqual": "11.0.2", "status": "affected", "version": "11.0", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access_container:10.0.9.1:*:*:*:*:*:*:*"], "product": "Security Verify Access Container", "vendor": "IBM", "versions": [{"lessThanOrEqual": "10.0.9.1", "status": "affected", "version": "10.0", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access:11.0.2:*:*:*:*:*:*:*"], "product": "Verify Identity Access", "vendor": "IBM", "versions": [{"lessThanOrEqual": "11.0.2", "status": "affected", "version": "11.0", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access:10.0.9.1:*:*:*:*:*:*:*"], "product": "Security Verify Access", "vendor": "IBM", "versions": [{"lessThanOrEqual": "10.0.9.1", "status": "affected", "version": "10.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*", "matchCriteriaId": "11212874-804C-42B2-AF5F-116F5C367237", "versionEndIncluding": "10.0.9.1", "versionStartIncluding": "10.0.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_verify_access_container:*:*:*:*:*:*:*:*", "matchCriteriaId": "674B3E72-09DE-48D4-9F07-43152474E8CD", "versionEndIncluding": "10.0.9.1", "versionStartIncluding": "10.0.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:*", "matchCriteriaId": "980521A4-FDCB-4EC4-9871-6CD57DEC14E1", "versionEndIncluding": "11.0.2.0", "versionStartIncluding": "11.0.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:verify_identity_access_container:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FDCBF44-E483-4248-A39E-CB9226FF4BC9", "versionEndIncluding": "11.0.2.0", "versionStartIncluding": "11.0.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information."}, {"lang": "es", "value": "IBM Verify Identity Access Contenedor 11.0 hasta 11.0.2 y IBM Security Verify Access Contenedor 10.0 hasta 10.0.9.1 y IBM Verify Identity Access 11.0 hasta 11.0.2 y IBM Security Verify Access 10.0 hasta 10.0.9.1 utilizan algoritmos criptogr\u00e1ficos m\u00e1s d\u00e9biles de lo esperado que podr\u00edan permitir a un atacante descifrar informaci\u00f3n altamente sensible."}], "id": "CVE-2026-5926", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5926", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-23T12:49:48.620762Z", "version": "2.0.3"}}]}, "published": "2026-04-23T00:16:46.743", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7269372"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-327"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0,10.0.9.1]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Security Verify Access", "source": "cna", "vendor": "IBM"}, "product": "security_verify_access", "vendor": "ibm"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0,10.0.9.1]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Security Verify Access Container", "source": "cna", "vendor": "IBM"}, "product": "security_verify_access_container", "vendor": "ibm"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0,11.0.2]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Verify Identity Access", "source": "cna", "vendor": "IBM"}, "product": "verify_identity_access", "vendor": "ibm"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0,11.0.2]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Verify Identity Access Container", "source": "cna", "vendor": "IBM"}, "product": "verify_identity_access_container", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-04-28T15:12:08.149253+00:00", "value": {"mitigation_remediation": ["Upgrade IBM Verify Identity Access to version 11.0.2 or later.", "Upgrade IBM Security Verify Access to version 10.0.9.1 or later.", "For container deployments, download and deploy the updated container images for the corresponding product versions."], "summary": {"action": "Patch immediately", "impact": "Weak cryptographic algorithms may enable decryption of sensitive data"}, "threat_synthesis": {"affected_systems": "The affected products are IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1, including their containerized editions for the same version ranges. Customers running any of these versions should verify whether they are at risk and consider upgrading.", "description_and_impact": "The CVE involves IBM Verify Identity Access and IBM Security Verify Access products using weaker\u2011than\u2011expected cryptographic algorithms, allowing an attacker to decrypt highly sensitive information. This weakness, identified as CWE\u2011327, compromises data confidentiality and may enable further compromise if the attacker gains access to protected data.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity, but the EPSS score of less than 1% suggests low likelihood that this vulnerability will be actively exploited in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Based on the description, the most likely attack vector would be remote, where an attacker with access to encrypted communications could attempt to decrypt data if the system is using vulnerable algorithms. The vulnerability requires the victim to be running an affected version and that the application is configured to use the weak cryptographic algorithms."}}}}, "created": "2026-04-28T05:15:22.723870+00:00", "updated": "2026-04-28T15:15:34.208704+00:00", "vendors": ["ibm", "ibm$PRODUCT$security_verify_access", "ibm$PRODUCT$security_verify_access_container", "ibm$PRODUCT$verify_identity_access", "ibm$PRODUCT$verify_identity_access_container"]}