CVE-2026-12342: SailPoint IdentityIQ Improper Form Validation Vulnerability

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-28 · updated 2026-09-30
Weakness: CWE-20

Description

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.

Affected products

SailPoint IdentityIQ: from 8.5 through 8.5p2; from 8.4 through 8.4p4; from 8.3 through 8.3p5

References

https://www.sailpoint.com/security-advisories/

Get alerted when CVE-2026-12342 or the next vulnerability affects your stack