IBM Security Verify Access Deserialization CVE-2026-78401

The management interface of IBM Security Verify Access processes untrusted data in a way that allows an unauthenticated remote attacker to execute arbitrary code. This vulnerability, tracked as CVE-2026-78401 , stems from improper deserialization, classified as CWE-502. It is not an authentication bypass; the system processes the malicious payload directly, leading to code execution without requiring a valid login. IBM disclosed the issue in a security bulletin on October 7, 2026. The company assigned a CVSS 3.1 score of 9.8, marking it as critical.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.