CVE-2026-13267 Overview
CVE-2026-13267 is a privilege escalation vulnerability affecting IBM Security Verify Access and IBM Verify Identity Access. An authenticated user can send a specially crafted request to gain the privileges of another user. The flaw is classified under CWE-302: Authentication Bypass by Assumed-Immutable Data and impacts identity and access management deployments that broker authentication for enterprise applications.
Critical Impact
An authenticated low-privilege user can assume another user's identity through a crafted request, enabling horizontal or vertical privilege escalation across the identity broker.
Affected Products
- IBM Security Verify Access 10.0 through 10.0.9.2
- IBM Verify Identity Access 11.0 through 11.0.3
- IBM Verify Identity Access Container 11.0 through 11.0.3
Discovery Timeline
- 2026-08-12 - CVE-2026-13267 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-13267
Vulnerability Analysis
CVE-2026-13267 is a privilege escalation flaw in IBM's identity access products. The vulnerability allows an authenticated user to elevate to the privileges of another user by submitting a specially crafted request to the affected service. Because IBM Security Verify Access and IBM Verify Identity Access act as authentication brokers for downstream applications, successful exploitation can extend an attacker's reach to any resource protected by the platform.
The issue is categorized as [CWE-302], which involves trusting data that should not be treated as immutable during authentication decisions. In practice, an attacker with valid credentials manipulates request parameters that the server assumes cannot be tampered with, causing the platform to treat the session as belonging to a different principal.
Root Cause
The root cause lies in the authentication logic accepting user-influenced data as authoritative when determining the acting identity. When the platform evaluates a crafted request, it fails to re-validate the binding between the authenticated session and the target user identity. This design gap allows the attacker to substitute another user's identity without re-authentication.
Attack Vector
Exploitation requires network access and valid low-privilege credentials on the target instance. No user interaction is required, and attack complexity is low. Once authenticated, the attacker crafts a request that manipulates identity-related fields, causing the server to authorize actions under a different user's context. The vulnerability affects confidentiality and integrity but not availability.
No verified public exploit code is currently available. Refer to the IBM Support Page for vendor-provided technical detail.
Detection Methods for CVE-2026-13267
Indicators of Compromise
- Authentication or authorization log entries showing a session identifier associated with one user performing actions attributed to a different user identity.
- Unexpected privilege changes, role assignments, or administrative actions initiated from accounts that historically lack such permissions.
- Repeated malformed or unusually structured requests to Verify Access authentication endpoints from a single authenticated session.
Detection Strategies
- Correlate session identifiers with acting user IDs across authentication and application logs to identify identity substitution.
- Baseline normal request structures to Verify Access endpoints and alert on requests that include unexpected identity or subject parameters.
- Monitor for privilege boundary crossings, especially standard users invoking administrative functions within the Verify Access console or API.
Monitoring Recommendations
- Forward IBM Verify Access audit logs to a centralized SIEM and enable retention sufficient to reconstruct multi-step identity abuse.
- Enable verbose authentication logging on the Verify Access reverse proxy and policy server for the duration of investigation and remediation.
- Alert on high-value account activity, including administrator and service account sessions, originating from unexpected source addresses.
How to Mitigate CVE-2026-13267
Immediate Actions Required
- Apply the fixed versions published by IBM as referenced in the IBM Support Page as soon as change control allows.
- Inventory all IBM Security Verify Access 10.0.x and IBM Verify Identity Access 11.0.x deployments, including containerized instances.
- Rotate credentials and session tokens for accounts that may have been targeted, particularly administrative accounts.
Patch Information
IBM has published guidance and fixed builds through the vendor advisory at the IBM Support Page. Administrators should review the advisory for the specific fix levels applicable to Security Verify Access 10.0.9.2 and earlier, Verify Identity Access 11.0.3 and earlier, and the Verify Identity Access Container edition.
Workarounds
- Restrict network access to the Verify Access administrative and authentication endpoints to trusted management networks until patches are applied.
- Enforce multi-factor authentication for all users of the platform to raise the cost of obtaining the low-privilege credentials required for exploitation.
- Reduce the attack surface by disabling unused authentication mechanisms and API endpoints exposed by Verify Access.
# Configuration example
# Restrict access to Verify Access management endpoints at the network layer
# (illustrative iptables rules; adapt to your environment)
iptables -A INPUT -p tcp --dport 9443 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
