CVE-2026-12342
CriticalCVSS 9.6Summary
A vulnerability in IdentityIQ (all versions) allows an unauthenticated user to perform remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.
Risk Assessment
Remote code execution without authentication can lead to full compromise of the IdentityIQ server, potentially resulting in exposure of identity and entitlement data.
Recommendation
Immediately apply patches provided by the vendor (SailPoint) for IdentityIQ. Restrict access to the API and implement additional authentication and input validation mechanisms.
Other vulnerabilities in IdentityIQ
See all- CVE-2026-5712High
This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.
- CVE-2026-12341High
All versions of IdentityIQ are vulnerable to unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens. An unauthenticated attacker can exploit this.
Original NVD description (English source)
This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS