CVE-2026-13260: IBM Verify Identity Access Remote Denial-of-Service Flaw

Overview

IBM has disclosed CVE-2026-13260 (CVSS 7.5, High), a denial-of-service vulnerability in IBM Verify Identity Access and its predecessor product IBM Security Verify Access — the identity and access management / web reverse-proxy platform many enterprises use to front-end web applications with authentication and authorization. Per NVD, the flaw "could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources."

The vulnerability requires no authentication and no user interaction, and is reachable over the network — an attacker who can send requests to an exposed IBM Verify Identity Access / Security Verify Access instance can trigger the condition directly. IBM has not published deep technical detail on the specific code path involved (for example, which component parses the "incoming request resources," or what a proof-of-concept request looks like); this advisory reflects what has been confirmed publicly as of publication.

Technical Details

How It Works

The CVSS vector (C:N/I:N/A:H) confirms this is a pure availability issue — no data is read or modified, but the service can be knocked offline. The CWE classification, CWE-770 (Allocation of Resources Without Limits or Throttling), points to a component that accepts attacker-controlled input describing a request "resource" (the NVD wording) without imposing a limit on size, count, or the work required to process it, allowing a remote requester to force the server to over-allocate memory, threads, connections, or CPU until it stops serving legitimate traffic.

IBM's public description does not go further than that summary — it does not name the specific listener, endpoint, or parser involved, nor has IBM published a proof-of-concept or exploitation writeup. Given the affected component family (Verify Identity Access / Security Verify Access ships a reverse proxy, a runtime/authorization server, and a Local Management Interface), the most plausible exposure is the internet- or intranet-facing reverse proxy that terminates client connections before authentication occurs, since the flaw requires no credentials — but IBM has not confirmed which component is responsible, so this should be treated as informed context rather than a confirmed detail.

Impact Assessment

Who Is At Risk

• Organizations running IBM Verify Identity Access 11.0.0–11.0.3 Interim Fix 001 or IBM Security Verify Access 10.0.0–10.0.9.2 Interim Fix 001 (appliance or container form) with any network-reachable listener exposed to untrusted clients
• Deployments that front internet-facing applications with IBM's reverse proxy for authentication/SSO — these are, by definition, designed to accept unauthenticated connections from the public internet, which is exactly the access an unauthenticated DoS needs
• Environments where Verify Identity Access / Security Verify Access is a single point of failure for access to downstream applications — a successful DoS against the proxy or authentication tier can cascade into an outage for every application behind it
• Organizations that have not yet applied IBM's remediation for this advisory and cannot otherwise restrict inbound access to the affected listener

Potential Impact

Because this is a resource-exhaustion flaw rather than a code-execution or data-exposure one, the practical impact is service unavailability: legitimate users and dependent applications lose access to anything gated behind the affected Verify Identity Access / Security Verify Access instance until the service is restarted or recovers. For organizations using it as a centralized SSO/access-management gateway, that can mean an outage across multiple downstream applications simultaneously rather than a single system.

Mitigation

Immediate Actions

• Identify all IBM Verify Identity Access and IBM Security Verify Access instances (appliance and container) in your environment and check the installed version against the affected ranges above.
• Apply IBM's remediation. IBM's guidance for this advisory family points to interim fixes beyond the vulnerable boundary versions (11.0.3 Interim Fix 001 / 10.0.9.2 Interim Fix 001) — confirm the current fixed level and download it via IBM Fix Central or the container image repository referenced in IBM's bulletin (linked below) before applying, since IBM's exact fix identifier for this specific CVE was not independently confirmed at the time of writing.
• Until patched, restrict network exposure of the affected listener(s) to only the source networks that legitimately need access — do not expose the reverse proxy or management interfaces to broader networks than required.
• Front the deployment with rate limiting / connection throttling at a network layer you control (load balancer, WAF, upstream reverse proxy) as a compensating control while patching is scheduled, since the underlying product was not throttling these requests itself.

Detection Opportunities

• Monitor resource utilization (memory, connection counts, worker/thread pool saturation, CPU) on Verify Identity Access / Security Verify Access instances for sudden spikes correlated with a narrow set of source IPs or request patterns.
• Review reverse-proxy and application logs for unusual volumes of malformed, oversized, or repeated requests immediately preceding a service degradation or restart event.
• Alert on unexpected service restarts, health-check failures, or availability-monitoring gaps for the authentication/access-management tier specifically, since an outage here can be mistaken for a downstream application issue rather than the root cause.

Defence-in-Depth

• Apply IBM security bulletins for this product line promptly — Verify Identity Access / Security Verify Access has had a steady cadence of advisories in 2026 (see Background), and patching lag directly extends the exposure window for pre-authentication flaws like this one.
• Deploy resource and rate limits at every layer in front of authentication infrastructure (load balancer, CDN/WAF, the reverse proxy itself), rather than relying on the backend to self-throttle.
• Build redundancy into access-management infrastructure (multiple proxy/authentication nodes, health-checked failover) so a resource-exhaustion condition on one node does not take down access to everything behind it.
• Maintain an accurate inventory of IBM identity/access components and their patch levels — the number of distinct CVEs disclosed against this product family in recent bulletins makes manual tracking error-prone.

Background

IBM Verify Identity Access is the current name for a long-running IBM identity and access management product line: originally IBM Security Access Manager (formerly Tivoli Access Manager), renamed to IBM Security Verify Access at the 10.0 release in 2020, and renamed again to IBM Verify Identity Access at the 11.0.0 release. It ships a web reverse proxy, an authorization/runtime server, and a Local Management Interface, and is commonly deployed to add authentication and single sign-on in front of web applications.

CVE-2026-13260 was disclosed on September 14, 2026 as part of an active run of Verify Identity Access / Security Verify Access advisories through August and September 2026, alongside other CVEs affecting the same product line's reverse proxy and administrative components — including CVE-2026-13267, a separately-tracked CVSS 8.1 privilege-escalation issue reported around the same window. Readers managing this product should expect IBM to continue shipping interim fixes for this line on a regular cadence and should treat bulletin review as a recurring task rather than a one-time check.

References

• NVD — CVE-2026-13260
• IBM Support — Security Bulletin reference for CVE-2026-13260
• Strix.ai — CVE-2026-13260: Verify Identity Access Resource Exhaustion
• OffSeq Threat Radar — CVE-2026-13260
• IBM Docs — IBM Verify Identity Access Containers