Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-11936

CVE-2026-11936MEDIUM

IBM Security Verify Access — Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   R  C  L  L  N    5.4   .0012    1.6     —

AFFECTED
  Product                           Versions  Fixed
  Security Verify Access            10.0 –    —
  Verify Identity Access            11.0 –    —
  Security Verify Access Container  10.0 –    —
  Verify Identity Access Container  11.0 –    —

TIMELINE
  Jun 10  Reserved by ibm
  Oct 8   Published (CNA: ibm)
  Oct 9   RESCORED — CVE-2026-11936 (IBM Security Verify Access). CVSS 4.9 → 5.4 (NVD).

CWE-79 · CNA: ibm · CVSS v3.1 · 1 reference · NVD status: Analyzed

Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
June 10, 2026	Reserved	Reserved by ibm
October 8, 2026	Published	Published (CNA: ibm)
October 9, 2026	RESCORED	RESCORED — CVE-2026-11936 (IBM Security Verify Access). CVSS 4.9 → 5.4 (NVD).

Affected

Affected products and packages — 4 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
IBM	Security Verify Access	—	10.0	—
IBM	Verify Identity Access	—	11.0	—
IBM	Security Verify Access Container	—	10.0	—
IBM	Verify Identity Access Container	—	11.0	—

Weaknesses

CWE-79

References (1)

https://www.ibm.com/support/pages/node/7291628 [Vendor Advisory]

Authoritative record: CVE-2026-11936 at cve.org

Vendors: ibm

Weaknesses: CWE-79

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-11936 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.