Threat database

CVE-2026-12342 is a critical vulnerability in SailPoint Technologies IdentityIQ affecting versions 8.3 through 8.5p2. It allows unauthenticated remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-12341 is a high-severity vulnerability in SailPoint Technologies IdentityIQ versions 8.3, 8.4, and 8.5. It allows an unauthenticated attacker to gain unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance has been provided yet.

CVE-2026-5712 is a high-severity vulnerability in SailPoint Technologies IdentityIQ versions 8.3, 8.4, and 8.5. It allows an authenticated user who is the requestor or assignee of a work item to edit role definitions without having the proper role editing capability. This represents an incorrect authorization flaw (CWE-863) that could lead to unauthorized privilege escalation or role modification. No official patch or remediation guidance is currently available from the vendor. The vulnerability has not been reported as exploited in the wild.

CVE-2026-4857 is a high-severity authorization vulnerability in SailPoint Technologies IdentityIQ versions 8.4 and 8.5, including patch levels prior to 8.4p4 and 8.5p2. Authenticated users with the Debug Pages Read Only capability or any custom capability containing the ViewAccessDebugPage SPRight can incorrectly create new IdentityIQ objects. This improper authorization flaw could lead to unauthorized creation of objects within the system. No official patch or fix has been confirmed as available at this time. Until a fix is released, it is recommended to unassign the Debug Pages Read Only capability and any custom capabilities with the ViewAccessDebugPage SPRight from all identities and workgroups to mitigate risk.

IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via a URL path that will set the Content-Type to HTML allowing a requesting browser to interpret content not properly escaped to prevent Cross-Site Scripting (XSS).