IBM Security Verify Access Docker vulnerabilities

25 CVEs affecting IBM Security Verify Access Docker, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-36356, published 2025-10-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-39070, published 2022-02-02. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Security Verify Access 10.0.0.0, 10.0.1.0 and 10.0.2.0 with the advanced access control authentication service enabled could allow an attacker to authenticate as any user on the system. IBM…
CVE-2024-35133, published 2024-08-29. High severity, CVSS 8.2. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit…
CVE-2023-30999, published 2024-02-03. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow an attacker to cause…
CVE-2023-31004, published 2024-02-03. Critical severity, CVSS 9.0. EPSS: 1% chance of exploitation in the next 30 days. IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote attacker to…
CVE-2023-32327, published 2024-02-03. High severity, CVSS 7.1. EPSS: 1% chance of exploitation in the next 30 days. IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to an XML External…
CVE-2023-31006, published 2024-02-03. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to a denial of…
CVE-2023-43016, published 2024-02-03. High severity, CVSS 7.3. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote user to log…
CVE-2022-36775, published 2023-02-17. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an…
CVE-2024-45659, published 2025-02-04. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This…
CVE-2025-0163, published 2025-06-11. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Verify Access Appliance and Docker 10.0 through 10.0.8 could allow a remote attacker to enumerate usernames due to an observable response discrepancy of disabled accounts.

Latest

CVE-2025-36356, published 2025-10-06. Critical severity, CVSS 9.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated user to escalate their privileges to root…
CVE-2025-36355, published 2025-10-06. High severity, CVSS 8.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated user to execute malicious scripts from…
CVE-2025-36354, published 2025-10-06. High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow an unauthenticated user to execute arbitrary commands with…
CVE-2024-45657, published 2025-02-04. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment.
CVE-2024-43187, published 2025-02-04. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized…
CVE-2024-40700, published 2025-02-04. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript…
CVE-2024-45647, published 2025-01-20. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without…
CVE-2024-35141, published 2024-12-19. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to execution of unnecessary privileges.