CVE-2025-36354

HIGH

IBM Security Verify Access 10.0.0.0-10.0.9.0 and 11.0.0.0-11.0.1.0 - Unauthenticated OS Command Injection

Title source: llm
STIX 2.1

Description

IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input.

References (1)

Core 1
Core References
Patch, Vendor Advisory vendor-advisory patch
https://www.ibm.com/support/pages/node/7247215

Scores

CVSS v3 7.3
EPSS 0.0007
EPSS Percentile 21.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-78
Status published
Products (8)
ibm/security_verify_access 10.0.9.0 (3 CPE variants)
ibm/security_verify_access 10.0.0.0 - 10.0.9.0
ibm/security_verify_access_docker 10.0.9.0 (3 CPE variants)
ibm/security_verify_access_docker 10.0.0.0 - 10.0.9.0
ibm/verify_identity_access 11.0.1.0
ibm/verify_identity_access 11.0.0.0 - 11.0.1.0
ibm/verify_identity_access_docker 11.0.1.0
ibm/verify_identity_access_docker 11.0.0.0 - 11.0.1.0
Published Oct 06, 2025
Tracked Since Feb 18, 2026