{"affected":[{"product":"Security Verify Directory","source":"CNA: ibm","vendor":"IBM","versions":[{"lessThanOrEqual":"10.0.4","status":"affected","version":"10.0.0","versionType":"semver"}]},{"product":"Verify Directory","source":"CNA: ibm","vendor":"IBM","versions":[{"status":"affected","version":"11.0.0"}]}],"cveId":"CVE-2026-8640","cwes":["CWE-352"],"description":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the application.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":3.5,"severity":"low","source":"CNA: ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794163503843,"publishedAt":1794163503843,"references":[{"source":"CNA: ibm","tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7293828"}],"remediation":[{"kind":"fix","source":"CNA: ibm","text":"IBM strongly encourages customers to update their systems promptly.\n\n\n\n\n\nProduct(s)Affected Version(s)FixIBM Security Verify Directory10.0.0-10.0.4Download and install IBM Security Verify Directory v10.0.4.4\nDownload document -  https://www.ibm.com/support/pages/node/7292855 IBM Verify Directory11.0.0Download and install IBM Verify Directory v11.0.1.2\nDownload document -  https://www.ibm.com/support/pages/node/7290214"},{"kind":"fix","source":"CNA: ibm","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.ibm.com/support/pages/node/7293828"}],"revision":"afa19862ae0b49caac5a5a958117d2865d8d182dcae38e5843bc8afbb8ce9486","sources":[{"modifiedAt":1794163503843,"name":"CNA: ibm","retrievedAt":1794164954811,"url":"https://www.cve.org/CVERecord?id=CVE-2026-8640"}],"ssvc":null,"status":"published","title":"IBM Verify Directory is affected by multiple vulnerabilities","updatedAt":1794164954811}