## Summary
IBM Verify Identity Access is affected by CVE-2026-12358, where a remote attacker can cause a denial of service by sending requests that are not sufficiently validated for incoming request resources. The issue aligns with CWE-674 (uncontrolled recursion).
## Technical Details
- Vulnerability class: CWE-674: Uncontrolled Recursion
- Root issue (per NVD): insufficient validation of incoming request resources, enabling resource exhaustion leading to a service crash/hang.
- Attack characteristics (per provided CVSS):
- Network-based access (AV:N)
- No privileges required (PR:N)
- No user interaction (UI:N)
- High availability impact (A:H), with no confidentiality/integrity impact indicated (C:N, I:N).
## Affected
- Product: IBM Verify Identity Access
- Specific affected versions/builds: not provided in the supplied reference content.
## Impact
- Denial of service due to uncontrolled resource consumption/unbounded behavior triggered by crafted network requests.
- CVSS indicates availability is the primary risk (A:H) with otherwise neutral confidentiality/integrity (C:N, I:N).
## Mitigation
1. Apply the vendor’s security fix for CVE-2026-12358 as soon as it is available (IBM advisory page referenced, but no patch level details were included in the provided content).
2. Add compensating controls at the network layer to limit or filter abusive traffic patterns targeting IBM Verify Identity Access endpoints (exact endpoints not provided).
3. Monitor for spikes in request volume or malformed/atypical request patterns consistent with resource-exhaustion attempts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-674