CVE-2026-12004

HighCVSS 8.7/10Last modified Oct 23, 2026

Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

Weakness enumeration

CWE-134

Affected software

Vendor	Product	Versions
IBM	Security Verify Access	>= 10.0, <= 10.0.9.2
IBM	Verify Identity Access	>= 11.0, <= 11.0.3
IBM	Verify Identity Access Container	>= 11.0, <= 11.0.3
IBM	Security Verify Access Container	>= 10.0, <= 10.0.9.2

References

https://www.ibm.com/support/pages/node/7283079Vendor Advisory

Timeline

Published: Aug 12, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1200407.5The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 CVE-2026-1200437.5The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in al CVE-2026-1200465.3Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users CVE-2026-120057.2IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container CVE-2026-1200577.5psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without compari CVE-2026-1200587.5psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply w CVE-2026-1200596.8For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by CVE-2026-1200605.9psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction CVE-2026-1200617.5The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry sta CVE-2026-1200627.5SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other c CVE-2026-1200635.9When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the CVE-2026-1200647.5Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol wit