InfoSecBulletin Cybersecurity for mankind
IBM has issued fixes for three security vulnerabilities in its IBM Security Verify Access and IBM Verify Identity Access products. These issues could permit privilege escalation, command execution, and script injection. Customers are urged to install these patches right away to avoid exploitation in production environments.
CVE-2025-36355 lets authenticated users run harmful scripts beyond the product’s control. IBM warns that this could lead to client-side code injection or unauthorized script execution, with a CVSS Base Score of 8.5, indicating high severity.
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
Critical Cisco ISE Vulnerability Enables Remote Code Execution
F5 Patches NGINX Flaw for Code Execution and DoS Attacks
FortiBleed: 70,000 Fortinet Firewalls Compromised Globally
New Rokarolla Android malware hits 217 banking and crypto apps
Phishing Campaign Exploits Legitimate Microsoft Login Flow
ALERT
Cisco SD-WAN Zero-Day, FortiSandbox and cPanel flaws exploited in attacks
“Panthalassa” builds floating AI data centers powered by ocean waves
Critical Wazuh Vuln Enables Alert Tampering and Evidence Deletion
“IBM Security Verify Access could allow a locally authenticated user to execute malicious scripts from outside of its control sphere,” the company explains.
CVE-2025-36356 is a critical vulnerability rated 9.3 on the CVSS scale. It allows local users to gain root privileges due to incorrect permission handling, giving attackers full administrative control from minimal access.
“IBM Security Verify Access could allow a locally authenticated user to escalate their privileges to root due to execution with more privileges than required,” IBM confirms in its bulletin.
CVE-2025-36354 affects systems open to unauthenticated users, allowing execution of arbitrary commands with lower privileges. It arises from improper validation of user input and, while rated 7.3, still poses a risk for externally accessible systems.
“IBM Security Verify Access could allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input,” according to IBM.
“Security vulnerabilities have been addressed in IBM Security Verify Access 10.0.9.0-IF3 and IBM Verify Identity Access 11.0.1.0-IF1,” the advisory states, emphasizing that organizations running earlier versions remain exposed until updates are applied.
IBM has identified the affected products and versions for both containerized and appliance deployments.
IBM Verify Identity Access (Docker & Appliance): Versions 11.0.0.0 – 11.0.1.0
IBM Security Verify Access (Docker & Appliance): Versions 10.0.0.0 – 10.0.9.0-IF2
These vulnerabilities impact systems that control access and verify identities, so it’s essential to patch them quickly for network security.
IBM has released Fix Packs 10.0.9.0-IF3 for Verify Access and 11.0.1.0-IF1 for Verify Identity Access, accessible via IBM Fix Central and container registries.
For container deployments, administrators can pull the latest versions directly from IBM’s registry:
docker pull icr.io/isva/verify-access:[latest-tag] docker pull icr.io/ivia/verify-access:[latest-tag]
Each tag corresponds to the latest patched release and can be verified on IBM’s official documentation portal.
