CVE-2026-8860mediumCWE-650

CVE-2026-8860: medium-severity vulnerability in IBM Verify Directory

IBM Verify Directory is affected by multiple vulnerabilities

Published · Updated

Follow this CVE+ Monitor Security Verify Directory+ Monitor Verify Directory

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.3%
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
IBM · Security Verify DirectoryIBM · Verify Directory
Related CVEs — IBM Verify Directory

In the same product, most dangerous first.

CVE-2024-51450CRITICALIBM Security Verify Directory Command ExecutionEPSS 1.1%CVE-2022-32756LOWIBM Security Verify Directory information disclosureEPSS 0.5%CVE-2022-32751MEDIUMIBM Security Verify Directory information disclosureEPSS 0.5%CVE-2024-45650HIGHIBM Security Verify Directory denial of serviceEPSS 0.4%CVE-2026-8639HIGHIBM Verify Directory is affected by multiple vulnerabilitiesEPSS 0.3%CVE-2022-32754MEDIUMIBM Security Verify Directory cross-site scriptingEPSS 0.3%