CVE-2026-12004

This CVE—CVSS 8.7, a format string vulnerability in IBM Verify Access management interface (versions 10.0 through 11.0.3)—is being undersold by its EPSS score of 0.00348. The reason is instructive: EPSS treats 'authenticated access to management interface' as a meaningful privilege gate, but that assumption collapses in modern deployments. In containerized or cloud-managed IBM Verify Identity Access, the management plane is one misconfigured RBAC policy away from exposure. The question is not whether your network topology protects it, but whether your IAM product's own deployment model creates a path that doesn't require the same credential hygiene as a user login. The format string mechanism is telling. This vulnerability class peaked in the 1990s, was domesticated in public-facing code by the mid-2000s through secure coding training and static analysis, and then quietly recolonized internal tooling. The fix applied to your public API in 2005 was likely never applied to the management interface—either because that code predated your security tooling rollout, or because it was written by teams who transferred their caution only to surfaces they considered dangerous. Format string bugs survive in code that nobody wants to disturb because disturbing it might break the trust relationships it governs. Here's what makes this worse than a typical format string: the blast radius is measured not by who can reach the management port, but by what the management port can reach. IBM Verify Access terminates trust relationships between your directory, cloud providers, partner federations, and every downstream application authenticating through it. An attacker extracting session tokens or internal configuration through format string specifiers in error responses doesn't need to pivot—they're already at the center of your identity graph. Audit these three things now: First, confirm whether your deployment exposes the management interface through any path that an authenticated VPN user, cloud console session, or contractor credentials could reach—if so, treat this as internet-facing severity. Second, check whether your static analysis pipeline was ever configured to scan the management interface code path, or whether it only targets public-facing components. Third, identify whether that management interface code predates your organization's secure coding program—if it does, it's accumulating remediation debt in a code path nobody is scanning with the same rigor as new code. The CVE is a format string. The blast radius is everything that authenticates through your identity provider.

Reviewed through automated stages and approved by a human before publication.