CVE-2026-11934

HighCVSS 7.2/10Last modified Sep 16, 2026

Description

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
IBMVerify Identity Access>= 11.0.0, <= 11.0.3 Interim Fix 001
IBMSecurity Verify Access>= 10.0.0, <= 10.0.9.2 Interim Fix 001
IBMVerify Identity Access Container>= 11.0.0, <= 11.0.3 Interim Fix 001
IBMSecurity Verify Access Container>= 10.0.0, <= 10.0.9.2 Interim Fix 001

References

Timeline

Published
Sep 15, 2026
Last modified
Sep 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1193405.5Tesseract is an open source OCR engine. Prior to 5.5.4, GENERIC_2D_ARRAY::DeSerializeSize in src/ccstruct/matrix.h reads matrix dimensions aCVE-2026-1193410.0Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from aCVE-2026-1193425.3Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/vCVE-2026-1193436.8Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/creCVE-2026-1193449.1Cocos AI is a confidential computing system for AI. In version 0.8.2 and earlier, Cocos AI accepts trusted execution environment attestationCVE-2026-1193457.2Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection CVE-2026-119365.4IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain coCVE-2026-1193645.3ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP useCVE-2026-1193656.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for ElemeCVE-2026-1193667.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allowCVE-2026-1193675.4Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly ConfigurCVE-2026-1193685.3Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configur
CVE-2026-11934: High severity, CVSS 7.2 | Vulnix