Introduction
Unauthorized access to enterprise authentication infrastructure can lead to widespread compromise of sensitive systems and data. IBM Security Verify Access and IBM Verify Identity Access are widely deployed identity management products. Large enterprises, financial institutions, and government agencies use them to enforce authentication and access policies across critical applications.
IBM Security Verify Access (formerly ISAM) is IBM's flagship identity and access management product, used by Fortune 500 companies and public sector organizations around the world. It provides centralized authentication, single sign-on, and policy enforcement for web and cloud applications. Because the product is so broadly adopted and so closely integrated with sensitive environments, a vulnerability in its core components has high impact.
Technical information
CVE-2025-36087 is a high-severity vulnerability (CVSS 8.1) caused by hard-coded credentials in IBM Security Verify Access 10.0.0 through 10.0.9 and 11.0.0, and in IBM Verify Identity Access Container 10.0.0 through 10.0.9 and 11.0.0. It is classified under CWE-798 (Use of Hard-coded Credentials).
Affected versions contain static passwords or cryptographic keys embedded directly in application binaries or configuration files. These credentials may be used for:
- Inbound authentication to the product itself
- Outbound authentication to external components (such as LDAP, databases, or other services)
- Encryption of internal data
An attacker who gains access to the binaries, configuration files, or system memory can extract these credentials. With them, the attacker can bypass authentication controls, impersonate legitimate users or services, or decrypt sensitive data the product protects. The risk grows when the same credentials are reused across multiple installations, which is common with hard-coded values.
The vulnerability is present only under certain configurations, and IBM has not publicly disclosed the exact conditions that trigger it. As of this writing, no public code snippets or exploit details are available.
Affected systems and versions
- IBM Security Verify Access 10.0.0 through 10.0.9
- IBM Security Verify Access 11.0.0
- IBM Verify Identity Access Container 10.0.0 through 10.0.9
- IBM Verify Identity Access Container 11.0.0
The vulnerability is exploitable only under certain configurations, which IBM has not specified. Organizations must review their deployments and consult IBM's advisory for details.
Vendor security history
IBM Security Verify Access has had multiple critical vulnerabilities in credential management and authentication, including:
- CVE-2024-49805 and CVE-2024-49806 (hard-coded credentials, CVSS 9.8)
- CVE-2024-49803 (remote command injection, CVSS 8.8)
- CVE-2024-49804 (privilege escalation, CVSS 7.8)
- Multiple authentication bypass and privilege escalation issues documented by independent researchers (Pierre Kim, 2024)
IBM typically responds with coordinated disclosures and patch releases. Even so, hard-coded credential vulnerabilities keep recurring across major versions, which points to ongoing problems in IBM's secure development and credential management processes.
References
- NVD entry for CVE-2025-36087
- IBM Security Bulletin for CVE-2025-36087
- CWE-798: Use of Hard-coded Credentials
- Pierre Kim: 32 Vulnerabilities in IBM Security Verify Access (2024)
- IBM Security Bulletin: Multiple vulnerabilities in IBM Security Verify Access Appliance (CVE-2024-49803, CVE-2024-49804, CVE-2024-49805, CVE-2024-49806)
