CVE-2026-8860

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8860", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-05-18T18:33:40.319Z", "datePublished": "2026-11-08T18:46:12.242Z", "dateUpdated": "2026-11-09T19:27:19.394Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T18:46:12.242Z"}, "title": "IBM Verify Directory is affected by multiple vulnerabilities", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-650", "description": "CWE-650 Trusting HTTP Permission Methods on the Server Side", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Security Verify Directory", "versions": [{"status": "affected", "version": "10.0.0", "lessThanOrEqual": "10.0.4", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:*"]}, {"vendor": "IBM", "product": "Verify Directory", "versions": [{"status": "affected", "version": "11.0.0"}], "cpes": ["cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7293828", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "IBM strongly encourages customers to update their systems promptly.\n\n\n\n\n\nProduct(s)Affected Version(s)FixIBM Security Verify Directory10.0.0-10.0.4Download and install IBM Security Verify Directory v10.0.4.4\nDownload document - https://www.ibm.com/support/pages/node/7292855 IBM Verify Directory11.0.0Download and install IBM Verify Directory v11.0.1.2\nDownload document - https://www.ibm.com/support/pages/node/7290214", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><strong>IBM strongly encourages customers to update their systems promptly.</strong></p><p></p><div><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Affected Version(s)</strong></td><td><strong>Fix</strong></td></tr><tr><td>IBM Security Verify Directory</td><td>10.0.0-10.0.4</td><td>Download and install IBM Security Verify Directory v10.0.4.4<br/>Download document - <a href=\"https://www.ibm.com/support/pages/node/7292855\" rel=\"nofollow\">https://www.ibm.com/support/pages/node/7292855</a></td></tr><tr><td>IBM Verify Directory</td><td>11.0.0</td><td>Download and install IBM Verify Directory v11.0.1.2<br/>Download document - <a href=\"https://www.ibm.com/support/pages/node/7290214\" rel=\"nofollow\">https://www.ibm.com/support/pages/node/7290214</a></td></tr></tbody></table></div><p></p>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T19:26:36.414420Z", "id": "CVE-2026-8860", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T19:27:19.394Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8860", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T19:26:36.414420Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T19:26:41.635Z"}}], "cna": {"title": "IBM Verify Directory is affected by multiple vulnerabilities", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Security Verify Directory", "versions": [{"status": "affected", "version": "10.0.0", "versionType": "semver", "lessThanOrEqual": "10.0.4"}]}, {"cpes": ["cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Verify Directory", "versions": [{"status": "affected", "version": "11.0.0"}]}], "solutions": [{"lang": "en", "value": "IBM strongly encourages customers to update their systems promptly.\n\n\n\n\n\nProduct(s)Affected Version(s)FixIBM Security Verify Directory10.0.0-10.0.4Download and install IBM Security Verify Directory v10.0.4.4\nDownload document - https://www.ibm.com/support/pages/node/7292855 IBM Verify Directory11.0.0Download and install IBM Verify Directory v11.0.1.2\nDownload document - https://www.ibm.com/support/pages/node/7290214", "supportingMedia": [{"type": "text/html", "value": "<p><strong>IBM strongly encourages customers to update their systems promptly.</strong></p><p></p><div><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Affected Version(s)</strong></td><td><strong>Fix</strong></td></tr><tr><td>IBM Security Verify Directory</td><td>10.0.0-10.0.4</td><td>Download and install IBM Security Verify Directory v10.0.4.4<br/>Download document - <a href=\"https://www.ibm.com/support/pages/node/7292855\" rel=\"nofollow\">https://www.ibm.com/support/pages/node/7292855</a></td></tr><tr><td>IBM Verify Directory</td><td>11.0.0</td><td>Download and install IBM Verify Directory v11.0.1.2<br/>Download document - <a href=\"https://www.ibm.com/support/pages/node/7290214\" rel=\"nofollow\">https://www.ibm.com/support/pages/node/7290214</a></td></tr></tbody></table></div><p></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7293828", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en", "value": "IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-650", "description": "CWE-650 Trusting HTTP Permission Methods on the Server Side"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T18:46:12.242Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8860", "state": "PUBLISHED", "dateUpdated": "2026-11-09T19:27:19.394Z", "dateReserved": "2026-05-18T18:33:40.319Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-11-08T18:46:12.242Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:*"], "product": "Security Verify Directory", "vendor": "IBM", "versions": [{"lessThanOrEqual": "10.0.4", "status": "affected", "version": "10.0.0", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:*"], "product": "Verify Directory", "vendor": "IBM", "versions": [{"status": "affected", "version": "11.0.0"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs."}], "id": "CVE-2026-8860", "lastModified": "2026-11-09T20:18:15.340", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8860", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T19:26:36.414420Z", "version": "2.0.3"}}]}, "published": "2026-11-08T19:17:43.020", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7293828"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-650"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.0.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Security Verify Directory", "source": "cna", "vendor": "IBM"}, "product": "security_verify_directory", "vendor": "ibm"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "11.0.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Verify Directory", "source": "cna", "vendor": "IBM"}, "product": "verify_directory", "vendor": "ibm"}], "created": "2026-11-08T20:30:14.594894+00:00", "updated": "2026-11-09T16:37:44.888722+00:00", "vendors": ["ibm", "ibm$PRODUCT$security_verify_directory", "ibm$PRODUCT$verify_directory"]}