IBM Security Verify Directory: Session Fixation (CVE-2026-8639)
IBM Security Verify Directory is affected by a session fixation vulnerability (CVE-2026-8639) that allows an attacker with low privileges to hijack an authenticated management console session.
CVE search metadata
CVE search record: CVE-2026-8639. Severity: high. CVSS: 8.8. KEV: no. Product: IBM Security Verify Directory 10.0.0 through 10.0.4, IBM Security Verify Directory 11.0.0. Brief: IBM Security Verify Directory: Session Fixation (CVE-2026-8639). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-verify-directory-session-fixation/
Triage facts
Revision 1- Applicability
- IBM Security Verify Directory 10.0.0 through 10.0.4, IBM Security Verify Directory 11.0.0
- Evidence
- Not observed
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 8, 20:56 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
IBM Security Verify Directory 10.0.0 through 10.0.4 and 11.0.0 are vulnerable to session fixation. An attacker with low privileges can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console. A public proof-of-concept (PoC) exploit for this vulnerability is available on Sploitus.