CVE-2026-11928

CriticalCVSS 9.8/10Last modified Sep 17, 2026

Description

IBM Verify Identity Access is vulnerable to a buffer overflow attack.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
IBMVerify Identity Access>= 11.0.0, <= 11.0.3 Interim Fix 001
IBMSecurity Verify Access>= 10.0.0, <= 10.0.9.2 Interim Fix 001
IBMVerify Identity Access Container>= 11.0.0, <= 11.0.3 Interim Fix 001
IBMSecurity Verify Access Container>= 10.0.0, <= 10.0.9.2 Interim Fix 001

References

Timeline

Published
Sep 15, 2026
Last modified
Sep 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1192803.7MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5CVE-2026-1192815.9MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5CVE-2026-1192827.3Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22CVE-2026-1192837.5joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, CVE-2026-1192846.9joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, CVE-2026-1192855.9Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher inCVE-2026-1192867.5GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidatCVE-2026-1192878.0Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-forCVE-2026-1192887.0Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat sCVE-2026-1192897.1Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dCVE-2026-119297.5IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of useCVE-2026-1192907.5Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes
CVE-2026-11928: Critical severity, CVSS 9.8 | Vulnix