CVE-2026-11923

HighCVSS 7.4/10Last modified Aug 17, 2026

Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Aug 12, 2026
Last modified: Aug 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-119233proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a CVE-2026-119234mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buf CVE-2026-119235proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been CVE-2026-119236An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already mo CVE-2026-119237In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding fo CVE-2026-1192383.3A potential improper permissions vulnerability was reported in Lenovo XiangBangbang that could allow a local application to perform unauthor CVE-2026-1192497.5A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to CVE-2026-119252.7Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.CVE-2026-1192507.8A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman CVE-2026-1192516.7A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for CVE-2026-1192595.3The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing i CVE-2026-119267.5IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request res