VulnerabilityAnalyzed

CVE-2026-17189

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting.

MEDIUM 6.1EPSS 0.15%

Does this matter?

Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.

Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.15% probability · 4th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-79
Affected: ibm/security verify access · ibm/security verify access container · ibm/verify identity access · ibm/verify identity access container
Source: psirt@us.ibm.com

EPSS trend

EPSS moved from 0.1% on 9 October 2026 to 0.1% on 27 October 2026.

References

https://www.ibm.com/support/pages/node/7291628Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.