Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 3 products
Format string injection in IBM Verify Access management interface. CVE-2026-12004. Versions 10.0–10.0.9.2 and 11.0–11.0.3. Here's what I'd check Friday if I ran this stack.
Post summary
The message discloses a format string injection vulnerability (CVE-2026-12004) affecting particular IBM Verify Access versions, without providing proof‑of‑concept or exploitation details.
Friday action: pull patch status for any IAM tooling you run. If you patch management interfaces on a different cadence than prod, align them. Format string vulns are decades old but still show up. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-12004
Post summary
A short advisory urging alignment of IAM patch cadence, noting that format string vulnerabilities remain a persistent concern.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ibm | security_verify_access | - | - | - |
| App | ibm | security_verify_access | 10.0.9.2 | - | - |
| App | ibm | verify_identity_access | - | - | - |
| App | ibm | verify_identity_access_container | - | - | - |