How severe is CVE-2026-19878?

CVE-2026-19878 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-19878 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-19878?

CVE-2026-19878 primarily affects Ibm Security Verify Access. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-19878?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-19878 published?

CVE-2026-19878 was published on 2026-10-08 and last updated on 2026-10-09.

CVE-2026-19878

CVE-2026-19878 is a medium-severity vulnerability in Ibm Security Verify Access with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-841.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (13th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-841
Affected product: Ibm Security Verify Access
Published: 2026-10-08
Last modified: 2026-10-09

Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass additional authentication workflow steps.

Frequently asked questions

What is CVE-2026-19878?: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass additional authentication workflow steps.
How severe is CVE-2026-19878?: CVE-2026-19878 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-19878 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-19878?: CVE-2026-19878 primarily affects Ibm Security Verify Access. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-19878?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-19878 published?: CVE-2026-19878 was published on 2026-10-08 and last updated on 2026-10-09.

References

https://www.ibm.com/support/pages/node/7291628

Affected products (4)

cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:*:*:*:*:*:*:*:*

More vulnerabilities in Ibm Security Verify Access

CVE-2026-78406 — Critical (CVSS 9.8): IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a…
CVE-2026-78401 — Critical (CVSS 9.8): IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a…
CVE-2024-49803 — Critical (CVSS 9.8): IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute…
CVE-2021-39070 — Critical (CVSS 9.8): IBM Security Verify Access 10.0.0.0, 10.0.1.0 and 10.0.2.0 with the advanced access control authentication service…
CVE-2020-4499 — Critical (CVSS 9.8): IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client…
CVE-2024-49806 — Critical (CVSS 9.4): IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or…

All CVEs affecting Ibm Security Verify Access →

Other CWE-841 vulnerabilities

CVE-2026-3130 — Critical (CVSS 9.8): Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated…
CVE-2025-48481 — Critical (CVSS 9.8): FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated…
CVE-2022-2105 — Critical (CVSS 9.4): Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication,…
CVE-2026-34582 — Critical (CVSS 9.1): Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData…
CVE-2026-104626 — High (CVSS 8.8): A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a…
CVE-2026-95369 — High (CVSS 8.8): Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially…

Browse all CWE-841 vulnerabilities →