InfoSecBulletin Cybersecurity for mankind
IBM has issued fixes for three security vulnerabilities in its IBM Security Verify Access and IBM Verify Identity Access products. These issues could permit privilege escalation, command execution, and script injection. Customers are urged to install these patches right away to avoid exploitation in production environments.
CVE-2025-36355 lets authenticated users run harmful scripts beyond the product’s control. IBM warns that this could lead to client-side code injection or unauthorized script execution, with a CVSS Base Score of 8.5, indicating high severity.
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Apple Patches 28 Security Flaws in macOS, iOS, and iPadOS
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVD in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
“IBM Security Verify Access could allow a locally authenticated user to execute malicious scripts from outside of its control sphere,” the company explains.
CVE-2025-36356 is a critical vulnerability rated 9.3 on the CVSS scale. It allows local users to gain root privileges due to incorrect permission handling, giving attackers full administrative control from minimal access.
“IBM Security Verify Access could allow a locally authenticated user to escalate their privileges to root due to execution with more privileges than required,” IBM confirms in its bulletin.
CVE-2025-36354 affects systems open to unauthenticated users, allowing execution of arbitrary commands with lower privileges. It arises from improper validation of user input and, while rated 7.3, still poses a risk for externally accessible systems.
“IBM Security Verify Access could allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input,” according to IBM.
“Security vulnerabilities have been addressed in IBM Security Verify Access 10.0.9.0-IF3 and IBM Verify Identity Access 11.0.1.0-IF1,” the advisory states, emphasizing that organizations running earlier versions remain exposed until updates are applied.
IBM has identified the affected products and versions for both containerized and appliance deployments.
IBM Verify Identity Access (Docker & Appliance): Versions 11.0.0.0 – 11.0.1.0
IBM Security Verify Access (Docker & Appliance): Versions 10.0.0.0 – 10.0.9.0-IF2
These vulnerabilities impact systems that control access and verify identities, so it’s essential to patch them quickly for network security.
IBM has released Fix Packs 10.0.9.0-IF3 for Verify Access and 11.0.1.0-IF1 for Verify Identity Access, accessible via IBM Fix Central and container registries.
For container deployments, administrators can pull the latest versions directly from IBM’s registry:
docker pull icr.io/isva/verify-access:[latest-tag] docker pull icr.io/ivia/verify-access:[latest-tag]
Each tag corresponds to the latest patched release and can be verified on IBM’s official documentation portal.
