Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-19494

CVE-2026-19494MEDIUM

IBM Security Verify Access — Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  H  N    6.5   .0029   19.7     —

AFFECTED
  Product                           Versions  Fixed
  Security Verify Access            10.0 –    —
  Verify Identity Access            11.0 –    —
  Security Verify Access Container  10.0 –    —
  Verify Identity Access Container  11.0 –    —

TIMELINE
  Aug 10  Reserved by ibm
  Oct 8   Published (CNA: ibm)
  Oct 10  RESCORED — CVE-2026-19494 (IBM Security Verify Access). CVSS 8.1 → 6.5 (NVD).

CWE-287 · CNA: ibm · CVSS v3.1 · 1 reference · NVD status: Analyzed

Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 10, 2026	Reserved	Reserved by ibm
October 8, 2026	Published	Published (CNA: ibm)
October 10, 2026	RESCORED	RESCORED — CVE-2026-19494 (IBM Security Verify Access). CVSS 8.1 → 6.5 (NVD).

Affected

Affected products and packages — 4 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
IBM	Security Verify Access	—	10.0	—
IBM	Verify Identity Access	—	11.0	—
IBM	Security Verify Access Container	—	10.0	—
IBM	Verify Identity Access Container	—	11.0	—

Weaknesses

CWE-287

References (1)

https://www.ibm.com/support/pages/node/7291628 [Vendor Advisory]

Authoritative record: CVE-2026-19494 at cve.org

Vendors: ibm

Weaknesses: CWE-287

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-19494 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.