CVE-2026-13277: IBM Security Verify Access

Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days.

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

Affected products

• IBM Security Verify Access
• IBM Security Verify Access Container
• IBM Verify Identity Access
• IBM Verify Identity Access Container

Published 2026-09-14. Last modified 2026-09-16.