IBM Security Verify Access Deserialization CVE-2026-78401
Photo: Forkast
The management interface of IBM Security Verify Access processes untrusted data in a way that allows an unauthenticated remote attacker to execute arbitrary code. This vulnerability, tracked as CVE-2026-78401 , stems from improper deserialization, classified as CWE-502. It is not an authentication bypass; the system processes the malicious payload directly, leading to code execution without requiring a valid login. IBM disclosed the issue in a security bulletin on October 7, 2026. The company assigned a CVSS 3.1 score of 9.8, marking it as critical.
Source: Forkast
