External risk intelligence

IBM Security Verify Access and Verify Identity Access Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-16823

IBM Security Verify Access and IBM Verify Identity Access are enterprise identity and access management solutions designed to serve as public-facing authentication gateways, identity portals, and access control points. These products are intended to be internet-facing by design to manage authentication for users, making them highly reachable from the public internet in standard deployments.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a security vulnerability in IBM's Security Verify Access and Verify Identity Access products, which could allow unauthorized access by bypassing authentication controls. The potential for remote exploitation is a concern for systems managing user identities and access.

A flaw lets unauthenticated users bypass security.
Affects identity and access management systems.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach a vulnerable IBM Security Verify Access or IBM Verify Identity Access product over the network without needing any credentials. By exploiting improper authentication, they could bypass security checks, potentially leading to unauthorized access to sensitive information and systems.

No authentication required.
Attacker triggers improper authentication.
Bypass security, gain unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to bypass security restrictions when supported by the advisory. This means an attacker might be able to gain unauthorized access to protected resources or perform actions they are not permitted to do, potentially impacting the confidentiality and integrity of the system.

Unauthorized access to system resources.
Bypass security controls when exploited.
Compromise confidentiality and integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security and infrastructure teams are most likely responsible for addressing this vulnerability in IBM Security Verify Access and IBM Verify Identity Access, as these are typically internet-facing systems critical to authentication and access control. The immediate first step is to locate all instances of the affected software, confirm their exposure and criticality, identify the responsible system owners, and then prioritize remediation efforts based on the business risk.

Security and Infrastructure teams own this issue.
Verify reachability and business criticality first.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Security Verify Access and IBM Verify Identity Access?

These platforms function as enterprise-grade identity and access management gateways. Organizations use them to centralize authentication, enforce access policies, and manage user identities across various applications. Because they act as the gatekeepers for digital entry, they are commonly positioned to handle incoming traffic from both internal networks and the public internet to secure access to protected resources.

What does CVE-2026-16823 mean by improper authentication?

This CVE falls under the weakness class of Improper Authentication (CWE-287). In plain English, the software fails to correctly verify the identity of a user or system attempting to connect. Because the validation logic is flawed, the system essentially accepts a connection as legitimate even when the user has not provided valid credentials, allowing them to skip the login process entirely.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specifically crafted network requests to the affected IBM software. Because the system's authentication checks are bypassed, the attacker does not need a username, password, or any existing session to gain unauthorized entry. Simply interacting with the vulnerable network service is sufficient to activate the flaw; no prior access or account privileges are required.

Is my system at risk if it is internet-facing?

Yes, if you run these products, they are highly relevant. Halo Surface Signal identifies these platforms as solutions designed to be public-facing to manage authentication for users. Since they are built to be reachable from the internet, any instance exposed to the public network is a potential target for remote attackers attempting to exploit this authentication bypass.

What should I do first to address this security issue?

Begin by creating a comprehensive inventory of all IBM Security Verify Access and Verify Identity Access instances within your environment. Once identified, evaluate which systems are reachable from the network and determine the business criticality of each. Coordinate with your infrastructure and security teams to prioritize these assets for remediation, focusing on those most exposed to your network perimeter.

References

www.ibm.com/support/pages/node/7291628

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.