IBM Verify Identity Appliance Hard-Coded Credentials Enable Physical Privilege Escalation

IBM has disclosed a security flaw in its access management appliances that exposes organizations to physical privilege escalation. The issue, tracked as CVE-2026-109126, affects IBM Verify Identity Access and IBM Security Verify Access. According to the National Vulnerability Database, the flaw stems from the use of hard-coded credentials. This allows an attacker who is physically near the device to gain elevated privileges on the system.

Root cause

The underlying weakness is classified as CWE-798, which refers to the use of hard-coded credentials. In this scenario, the appliance contains static authentication details embedded within the system. The source material identifies the flaw specifically as the use of hard-coded credentials. This design allows for authentication without standard user-managed password policies. The presence of these credentials creates a vector for privilege escalation when physical access is available.

Attack path

Exploitation requires the attacker to be physically proximate to the vulnerable appliance. The source material states that a physically proximate attacker can gain elevated privileges. The attacker leverages the hard-coded credentials to authenticate to the system. Successful authentication grants the attacker elevated privileges. The source material does not specify further actions an attacker might take after gaining these privileges.

Affected versions

The following specific versions of IBM appliances are confirmed affected:

• IBM Verify Identity Access 11.0.3.1
• IBM Security Verify Access 10.0.9.3

Other versions of these products are not mentioned in the source material as being vulnerable. Organizations using different version numbers should verify their status with the vendor, but only the versions listed above are explicitly identified in the CVE record.

Mitigation

No fix or update has been confirmed in the source material. Until a patch is available, organizations must focus on physical security controls. Restricting physical access to the data center or server room is the primary defense. Ensure that only authorized personnel can approach the appliance hardware. Monitor physical access logs for any unauthorized attempts to reach the device.

Signals worth monitoring

Teams should review physical access logs for unusual activity near server racks or appliance locations. Look for signs of tampering with the hardware, such as unexpected reboots or configuration changes made from local console sessions. Check for new admin accounts or privilege changes that do not match authorized change requests. Investigate any successful local logins that occur outside of scheduled maintenance windows. Correlate physical security alerts with system audit logs to identify potential exploitation attempts.

Background: Hard-coded credentials

Hard-coded credentials persist in compiled binaries and version history, bypassing identity management. Fix this by moving secrets to external secret managers, using runtime injection, and rotating keys immediately upon discovery of static values in source code.

Read the full guide: Hard-Coded Credentials: 7 Mistakes That Leave Systems Open

What to do and how to stay safe: IBM

• Audit physical access controls for all locations housing IBM Verify Identity or Security Verify Access appliances.
• Review local login logs for authentication attempts using credentials that do not match standard admin accounts.
• Restrict physical access to the appliance hardware to only essential personnel during maintenance windows.
• Once the vendor provides an update, apply the patch immediately to resolve the hard-coded credential issue.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-109126?

The National Vulnerability Database rates the severity as High, with a CVSS score of 8.8.

Can this vulnerability be exploited remotely?

The source material specifies that the attacker must be physically proximate to the appliance to exploit the flaw.

Which IBM products are affected?

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance are the affected versions.