CVE-2026-1343
Published: 08 April 2026
Summary
CVE-2026-1343 is a high-severity SSRF (CWE-918) vulnerability in Ibm Security Verify Access. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation requires applying vendor patches to directly eliminate the SSRF vulnerability allowing attackers to contact internal authentication endpoints via the reverse proxy.
Boundary protection enforces controls at external interfaces like the reverse proxy to prevent unauthorized access to internal authentication endpoints.
Information input validation checks and rejects malicious inputs to the reverse proxy that enable SSRF attacks targeting internal endpoints.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF vulnerability in public-facing Reverse Proxy directly enables exploitation of a public-facing application (T1190) to reach protected internal endpoints.
NVD Description
IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 allows an attacker to contact internal authentication…
more
endpoints which are protected by the Reverse Proxy.
Deeper analysisAI
CVE-2026-1343 affects IBM Verify Identity Access Container versions 11.0 through 11.0.2, IBM Security Verify Access Container versions 10.0 through 10.0.9.1, IBM Verify Identity Access versions 11.0 through 11.0.2, and IBM Security Verify Access versions 10.0 through 10.0.9.1. The vulnerability enables an attacker to contact internal authentication endpoints protected by the Reverse Proxy, classified as CWE-918 (Server-Side Request Forgery). It carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to network accessibility and scope change.
An unauthenticated attacker with network access can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation allows the attacker to reach internal authentication endpoints, resulting in low impacts to confidentiality and integrity across the changed scope, such as potential unauthorized access or manipulation of protected resources.
The IBM security advisory provides details on mitigation and patches at https://www.ibm.com/support/pages/node/7268253.
Details
- CWE(s)