External risk intelligence

IBM Verify Access Hard-coded Credentials Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-36087

IBM Security Verify Access and Verify Identity Access are identity and access management solutions typically deployed as public-facing gateways or portals to handle user authentication, identity services, and access control, making their interfaces and associated services exposed to the internet by design.

Ibm Security Verify Access

10.0.0 to 10.0.911.0.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in certain IBM identity and access management products that could allow unauthorized access. The issue stems from hard-coded credentials, such as passwords or cryptographic keys, within the software which are used for authentication, communication, or data encryption. The potential impact is significant due to the sensitive nature of identity and access management systems.

Exposed credentials grant broad access.
This impacts core security functions.
Confirm relevance and review exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage hard-coded credentials within IBM Security Verify Access or Verify Identity Access to gain unauthorized access. This could allow them to authenticate to the system, communicate with external components, or decrypt sensitive internal data, depending on how the credentials are used.

No authentication required to access.
Vulnerable component exposed externally.
Compromise of credentials leads to data breach.

Live Threat

Current exploitation, exposure, and threat context

The presence of hard-coded credentials in IBM Security Verify Access and Verify Identity Access could allow an attacker to gain unauthorized access to sensitive system data, intercept outbound communications, or decrypt internal information. This risk exists when the affected systems are configured in a way that exposes these hard-coded secrets.

Sensitive system data and credentials.
Exposed by hard-coded secrets in configurations.
Unauthorized access and data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

In real-world scenarios, teams responsible for identity and access management solutions like IBM Security Verify Access and IBM Verify Identity Access are typically the primary actors. This includes platform or infrastructure teams managing the deployment, and potentially application owners if these solutions are deeply integrated into specific business applications. The initial practical step involves identifying all instances of the affected technology, confirming their reachability and business criticality, and then locating the accountable owner to plan a risk-based remediation.

Platform/App owners should address this.
Verify all affected deployments and reachability.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Security Verify Access?

IBM Security Verify Access and Verify Identity Access are identity and access management solutions. They serve as security gateways that handle user authentication, enforce access policies, and manage identity services across an organization's digital environment. Because they act as the front door for users trying to access protected applications and internal resources, they are critical components for verifying identities before granting entry.

What does CWE-798 mean for CVE-2025-36087?

CWE-798 refers to the use of hard-coded credentials. In this vulnerability, it means the software contains embedded secrets, like passwords or cryptographic keys, that are built directly into the code. Because these secrets are not unique or user-managed, they can be discovered and used to bypass security controls. In the context of this CVE, these hard-coded items are used for internal data encryption, inbound authentication, or communicating with other system parts.

How can an attacker trigger this vulnerability?

An attacker can trigger this issue by utilizing the hard-coded secrets to gain unauthorized access to the system. Since these credentials are part of the software itself, no special interaction or valid user authentication is required to attempt the exploit. It is important to note that the vulnerability is tied to the presence of these hard-coded secrets; it is not triggered by standard user behavior, but rather by the configuration that allows these hidden keys to be active.

Why is this a concern for internet-facing systems?

According to Halo Surface Signal, these identity management solutions are frequently deployed as public-facing gateways to facilitate remote access. This design choice means the affected software is often directly accessible from the internet. When a component with hard-coded credentials is exposed in this manner, it significantly lowers the barrier for an unauthorized party to connect, potentially leading to data interception or full system compromise.

Do I need to take action if I use this software?

Yes, you should begin by creating an inventory of all instances of the affected IBM products within your environment. Once you have identified these systems, assess their reachability and determine which are internet-facing. Coordinate with the relevant platform or application owners to plan your response based on the vendor's guidance, focusing on how to effectively address the risk posed by the hard-coded credentials in your specific deployment.

References

www.ibm.com/support/pages/node/7247753

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.