Critical Flaw CVE-2025-36356 (CVSS 9.3) in IBM Security Verify Access Allows Root Privilege Escalation

IBM has released fixes for three vulnerabilities affecting its Security Verify Access and Verify Identity Access products, warning that the issues could lead to privilege escalation, arbitrary command execution, and script injection. The second vulnerability, CVE-2025-36356, is rated 9.3 (Critical) on the CVSS scale and could allow a local user to escalate privileges to root due to improper permission handling, potentially granting full administrative control with minimal system access.

According to IBM, patches have been issued in the form of Fix Packs 10.0.9.0-IF3 for Verify Access and 11.0.1.0-IF1 for Verify Identity Access, with containerised and appliance deployments both affected. The article notes that CVE-2025-36355, with a CVSS of 8.5, allows a locally authenticated user to execute malicious scripts from outside the product’s control sphere, while CVE-2025-36354 enables arbitrary command execution for unauthenticated users on externally exposed deployments.

IBM lists affected versions as IBM Verify Identity Access (Docker & Appliance) 11.0.0[.]0–11.0.1[.]0 and IBM Security Verify Access (Docker & Appliance) 10.0.0[.]0–10.0.9[.]0-IF2, and urges organisations to apply updates promptly. According to the advisory, updates are available via IBM Fix Central and container registries.