CVE Alert: CVE-2025-36087 – IBM – Security Verify Access

Risk verdict

High risk: remote, unauthenticated network access is possible in affected configurations; patch promptly to avert exploitation.

Why this matters

Hard-coded credentials enable attackers to bypass authentication and access critical components, potentially exposing data, disrupting integrity, and compromising encryption keys. If compromised, an attacker could persist, exfiltrate sensitive data, or pivot to connected systems and external components.

Most likely attack path

Exploitation is network-facing with no user interaction and no privileges required, but with high attack complexity. An attacker would need to target the affected service in the wrong configuration where credentials are embedded; successful access could then be used to authenticate inbound or outbound connections and locate cryptographic material, enabling lateral movement to trusted components.

Who is most exposed

Organisations deploying IBM Security Verify Access or the container in internet-facing, DMZ, or broadly exposed containerised estates are at greatest risk, particularly where credentials are baked into images or configs.

Detection ideas

• Look for unusual outbound connections using embedded credentials or keys
• Inspect configs and container images for plain-text credentials or secret material
• Authentication events from unexpected IPs or geographies
• Anomalous outbound access to external components or encryption endpoints
• Recent builds/images containing hard-coded credentials

Mitigation and prioritisation

• Apply the official fixes: 10.0.9 IF2 and 11.0.1 for the affected lines
• Remove hard-coded credentials from all configurations; implement centralised secret management
• Rotate or revoke embedded credentials and keys; enforce least privilege
• Review and restrict inbound/outbound authentication pathways; segment management interfaces
• Plan patching during a controlled change window; test in staging before prod; verify post-patch connectivity and credential handling
• If KEV or EPSS indicators appear, escalate to priority 1 and accelerate remediation.