InfoSecBulletin Cybersecurity for mankind
A security bulletin alert points out several flaws in IMB Verify Identity Access and Security Verify Access products. Tracked as CVE-2026-2862 and CVE-2026-1491, these flaws in HTTP request smuggling come from problems with reverse proxy management and have a CVSS score of 5.3. A remote attacker who is not logged in can use this flaw to make the proxy server reveal internal web traffic.
CVE-2026-1188 (CVSS 9.8): A critical buffer overflow flaw in the Eclipse OMR port library. The system does not calculate buffer sizes correctly when reading processor features. This allows an attacker to cause a memory overflow, which can take over the entire system.
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
CVE-2026-1346 (CVSS 9.3): A severe flaw in the Security Verify Access Container that allows a locally authenticated user to escalate their system privileges directly to root.
CVE-2023-46233 (CVSS 9.1): A major weakness was found in the crypto-js library. The library defaults to SHA-1, an outdated and insecure hashing algorithm, and uses only a single iteration to set password difficulty. This severely weakens password and signature protections against brute-force attacks.
CVE-2026-1342 (CVSS 8.5): A vulnerability in the Container platform that lets locally authenticated users execute malicious scripts from an untrusted control sphere.
CVE-2026-4101 (CVSS 8.1): Under certain heavy load conditions, remote attackers could bypass existing authentication mechanisms and gain unauthorized entry into the application.
CVE-2026-1345 (CVSS 7.3): An OS command injection vulnerability allowing unauthenticated users to execute arbitrary commands due to improper input validation.
The bulletin talks about CVE-2026-1343 (Server-Side Request Forgery), CVE-2025-12635 (Cross-Site Scripting), and some Java SE resource use issues.
These security flaws affect IBM Verify Identity Access and IBM Security Verify Access versions 10.0 to 11.0.2, as well as their Container uses.
If these security problems are not fixed, bad actors could get sensitive information, gain higher system access, or completely stop the application from working.
Organizations that use these authentication platforms need to act fast to fix their systems.
