Introduction
A privilege escalation bug in an identity management platform can undermine the security of the whole organization that depends on it. CVE-2025-36356 lets a locally authenticated user gain root access on IBM Security Verify Access and IBM Verify Identity Access. These products run authentication and authorization, so root access on them puts critical infrastructure at risk.
IBM Security Verify Access is a widely used identity and access management solution for large enterprises. It handles authentication, authorization, and policy management across complex environments. Banks, Fortune 500 companies, and government agencies deploy it globally, which makes a vulnerability in this platform especially serious.
Technical information
CVE-2025-36356 is a privilege escalation vulnerability caused by improper privilege management (CWE-250) in IBM Security Verify Access and IBM Verify Identity Access. The flaw affects both appliance and containerized deployments, specifically:
- IBM Security Verify Access 10.0.0.0 through 10.0.9.0
- IBM Security Verify Access 11.0.0.0 through 11.0.1.0
- Corresponding Docker/container images
Some processes or operations in the product run with root or system-level privileges when they do not need that access. This design oversight violates the principle of least privilege and gives locally authenticated users a way to escalate their privileges. An attacker with local access who exploits these overprivileged operations can take root-level control of the affected system. From there, the attacker can fully compromise authentication policies and user databases, and potentially the downstream systems that rely on the platform for access control.
No public code snippets or proof of concept have been released for this vulnerability. The issue is classified under CWE-250: Execution with Unnecessary Privileges.
Patch information
IBM has released updates for several security vulnerabilities in IBM Security Verify Access and IBM Verify Identity Access. To fix them, update each installation to the latest version as follows:
-
IBM Security Verify Access (Container):
- Pull the latest version of the container by running:
Replacedocker pull icr.io/isva/verify-access:[tag][tag]with the latest published version, which you can confirm here.
- Pull the latest version of the container by running:
-
IBM Verify Identity Access (Container):
- Pull the latest version of the container by running:
Replacedocker pull icr.io/ivia/verify-access:[tag][tag]with the latest published version, which you can confirm here.
- Pull the latest version of the container by running:
-
IBM Security Verify Access (Appliance):
- Update to version 10.0.9.0-IF3.
-
IBM Verify Identity Access (Appliance):
- Update to version 11.0.1.0-IF1.
IBM strongly recommends that customers update their products at their earliest convenience to protect system security and integrity.
Patch source: https://www.ibm.com/support/pages/node/7247215
Affected systems and versions
- IBM Security Verify Access versions 10.0.0.0 through 10.0.9.0 (appliance and container)
- IBM Security Verify Access versions 11.0.0.0 through 11.0.1.0 (appliance and container)
- IBM Verify Identity Access versions matching the above ranges
- Both traditional appliance and Docker/container deployments are affected
Vendor security history
IBM Security Verify Access has had several privilege escalation and authentication bypass vulnerabilities in recent years. Related CVEs include:
- CVE-2025-36354 (privilege escalation)
- CVE-2025-36355 (privilege escalation)
- A set of 32 vulnerabilities disclosed by Pierre Kim in 2024, covering remote code execution, authentication bypass, and local privilege escalation
IBM's Product Security Incident Response Team (PSIRT) manages vulnerability disclosure and patch releases. IBM typically publishes advisories and fixes promptly. Still, the number and variety of recent issues reflect how complex the product is, and how hard identity platforms remain to secure.
