CVE-2026-12359 Overview
CVE-2026-12359 is an HTTP request smuggling vulnerability affecting IBM Security Verify Access and IBM Verify Identity Access. The flaw stems from inconsistent interpretation of HTTP requests by a reverse proxy component. A remote attacker can exploit this discrepancy to access sensitive information without authentication. The vulnerability is classified under [CWE-287] (Improper Authentication).
Critical Impact
A remote unauthenticated attacker can exploit request parsing inconsistencies to bypass authentication controls and access sensitive information handled by the reverse proxy.
Affected Products
- IBM Security Verify Access 10.0 through 10.0.9.2
- IBM Verify Identity Access 11.0 through 11.0.3
- IBM Verify Identity Access Container 11.0 through 11.0.3
Discovery Timeline
- 2026-08-12 - CVE-2026-12359 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-12359
Vulnerability Analysis
CVE-2026-12359 arises from how the reverse proxy in IBM Security Verify Access parses HTTP requests differently from downstream services. This inconsistency creates conditions for HTTP request smuggling, where an attacker crafts a single request that the proxy and backend interpret as two separate transactions. The mismatch enables the attacker to prepend malicious content to another user's request or bypass proxy-enforced access controls.
IBM Security Verify Access acts as an authenticating reverse proxy for enterprise applications. When request boundaries are ambiguous, authentication decisions made at the proxy layer no longer align with what the backend ultimately processes. Attackers can leverage this to reach protected resources without valid credentials or to exfiltrate cached responses intended for other sessions.
Root Cause
The root cause is inconsistent HTTP request interpretation between the reverse proxy and downstream components. Ambiguous handling of headers such as Content-Length and Transfer-Encoding allows a single TCP stream to be parsed as different sequences of requests. This desynchronization is the classic precondition for request smuggling attacks against authentication gateways.
Attack Vector
The vulnerability is exploitable over the network without authentication or user interaction. An attacker sends specially crafted HTTP requests to the Verify Access reverse proxy endpoint. The proxy forwards what it believes is a compliant request, while the backend interprets residual bytes as a second, smuggled request. Successful exploitation grants access to sensitive information, tampering with in-flight requests, or availability degradation.
Specific exploitation details have not been publicly released. Refer to the IBM Support Page for vendor-supplied technical guidance.
Detection Methods for CVE-2026-12359
Indicators of Compromise
- Unusual HTTP requests containing both Content-Length and Transfer-Encoding: chunked headers directed at Verify Access endpoints.
- Backend access logs showing requests without corresponding proxy log entries, or vice versa.
- Unexpected authenticated sessions or resource access from IP addresses that never completed a valid authentication flow.
Detection Strategies
- Deploy web application firewall rules that reject requests with conflicting length or encoding headers.
- Correlate reverse proxy access logs with backend application logs to identify request count or ordering mismatches.
- Alert on HTTP responses returned to a client that do not match the client's most recent request path.
Monitoring Recommendations
- Continuously monitor Verify Access reverse proxy telemetry for malformed HTTP framing and protocol anomalies.
- Track authentication decisions against downstream authorization events to detect divergence.
- Ingest proxy and backend logs into a centralized analytics platform for longitudinal review of parser disagreements.
How to Mitigate CVE-2026-12359
Immediate Actions Required
- Identify all deployments of IBM Security Verify Access 10.0.x and IBM Verify Identity Access 11.0.x within the environment.
- Apply the vendor-provided fixes referenced on the IBM Support Page as soon as they are available.
- Restrict network exposure of Verify Access reverse proxy interfaces to trusted networks pending remediation.
Patch Information
IBM has published remediation guidance for affected releases of Security Verify Access 10.0 through 10.0.9.2, Verify Identity Access 11.0 through 11.0.3, and Verify Identity Access Container 11.0 through 11.0.3. Consult the IBM Support Page for fixed versions and upgrade instructions.
Workarounds
- Place a strict HTTP-compliant WAF or intermediary in front of Verify Access that normalizes or rejects ambiguous requests.
- Disable HTTP keep-alive or reduce connection reuse on the reverse proxy to limit smuggling opportunities where operationally feasible.
- Enforce a single canonical request framing header and drop requests that supply both Content-Length and Transfer-Encoding.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
