A high-severity authentication bypass vulnerability in IBM Verify Identity Access and IBM Security Verify Access allows unauthenticated attackers to execute unauthorized commands.

The vulnerability is an authentication bypass (CWE-289) occurring when the system fails to properly validate user-supplied requests. This flaw allows an unauthenticated remote attacker to execute commands normally restricted to administrative users.

The vulnerability poses a severe risk to organizational security, as it grants unauthenticated actors the ability to perform unauthorized administrative actions. Given the CVSS score of 8.1, the potential for complete compromise of confidentiality, integrity, and availability is high. Successful exploitation could lead to full system takeover, unauthorized access to sensitive identity data, or significant operational disruption.

Immediate Action: Update to IBM Verify Identity Access version 11.0.3 IF2 or IBM Security Verify Access version 10.0.9.2 IF2 via the IBM Fix Central portal.

Proactive Monitoring: Review system and application logs for unusual administrative activity, specifically focusing on unauthorized command execution attempts or unexpected privilege escalation patterns.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to inspect incoming requests for suspicious patterns or anomalous input parameters that might attempt to bypass authentication mechanisms.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk due to the potential for unauthenticated administrative control. Organizations must prioritize the application of the provided interim fixes across all affected physical and containerized environments. Failure to patch these systems leaves critical identity infrastructure exposed to remote exploitation and potential full system compromise.