CVE-2026-12342 - Vulnerability Details - OpenCVE

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Sailpoint Technologies	Identityiq

No data.

No data.

References

Link	Providers
https://www.sailpoint.com/security-advisories/

History

Mon, 28 Sep 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 28 Sep 2026 18:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Sailpoint Technologies Sailpoint Technologies identityiq
Vendors & Products		Sailpoint Technologies Sailpoint Technologies identityiq

Mon, 28 Sep 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.
Title		SailPoint IdentityIQ Improper Form Validation Vulnerability
Weaknesses		CWE-20
References		https://www.sailpoint.com/security-advisories/
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: SailPoint

Published: 2026-09-28T15:45:21.242Z

Updated: 2026-09-29T03:55:25.765Z

Reserved: 2026-06-15T16:30:51.596Z

Link: CVE-2026-12342

Vulnrichment

Updated: 2026-09-28T17:53:16.146Z

NVD

Status : Awaiting Analysis

Published: 2026-09-28T16:17:13.460

Modified: 2026-09-30T17:23:08.953

Link: CVE-2026-12342

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12342", "assignerOrgId": "2cfc7547-56a0-4049-8b52-c3078e8a8719", "state": "PUBLISHED", "assignerShortName": "SailPoint", "dateReserved": "2026-06-15T16:30:51.596Z", "datePublished": "2026-09-28T15:45:21.242Z", "dateUpdated": "2026-09-29T03:55:25.765Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2cfc7547-56a0-4049-8b52-c3078e8a8719", "shortName": "SailPoint", "dateUpdated": "2026-09-28T15:45:21.242Z"}, "title": "SailPoint IdentityIQ Improper Form Validation Vulnerability", "datePublic": "2026-09-28T19:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper input validation", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-76", "descriptions": [{"lang": "en", "value": "CAPEC-76 Manipulating Web Input to File System Calls"}]}], "affected": [{"vendor": "SailPoint Technologies", "product": "IdentityIQ", "versions": [{"status": "affected", "version": "8.5", "lessThanOrEqual": "8.5p2", "versionType": "custom"}, {"status": "affected", "version": "8.4", "lessThanOrEqual": "8.4p4", "versionType": "custom"}, {"status": "affected", "version": "8.3", "lessThanOrEqual": "8.3p5", "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "This vulnerability\nimpacts all versions of IdentityIQ and allows an unauthenticated user remote\ncode execution on the IdentityIQ server due to improper input validation of\nsubmitted web service API content.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>\n\n<p>This vulnerability\nimpacts all versions of IdentityIQ and allows an unauthenticated user remote\ncode execution on the IdentityIQ server due to improper input validation of\nsubmitted web service API content.</p>\n\n</div>"}]}], "references": [{"url": "https://www.sailpoint.com/security-advisories/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.6, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "taise", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-28T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-12342"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T03:55:25.765Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12342", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-28T16:30:12.176710Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-28T17:53:16.146Z"}}], "cna": {"title": "SailPoint IdentityIQ Improper Form Validation Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "taise"}], "impacts": [{"capecId": "CAPEC-76", "descriptions": [{"lang": "en", "value": "CAPEC-76 Manipulating Web Input to File System Calls"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SailPoint Technologies", "product": "IdentityIQ", "versions": [{"status": "affected", "version": "8.5", "versionType": "custom", "lessThanOrEqual": "8.5p2"}, {"status": "affected", "version": "8.4", "versionType": "custom", "lessThanOrEqual": "8.4p4"}, {"status": "affected", "version": "8.3", "versionType": "custom", "lessThanOrEqual": "8.3p5"}], "defaultStatus": "affected"}], "datePublic": "2026-09-28T19:00:00.000Z", "references": [{"url": "https://www.sailpoint.com/security-advisories/"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "This vulnerability\nimpacts all versions of IdentityIQ and allows an unauthenticated user remote\ncode execution on the IdentityIQ server due to improper input validation of\nsubmitted web service API content.", "supportingMedia": [{"type": "text/html", "value": "<div>\n\n<p>This vulnerability\nimpacts all versions of IdentityIQ and allows an unauthenticated user remote\ncode execution on the IdentityIQ server due to improper input validation of\nsubmitted web service API content.</p>\n\n</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper input validation"}]}], "providerMetadata": {"orgId": "2cfc7547-56a0-4049-8b52-c3078e8a8719", "shortName": "SailPoint", "dateUpdated": "2026-09-28T15:45:21.242Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12342", "state": "PUBLISHED", "dateUpdated": "2026-09-28T18:02:57.009Z", "dateReserved": "2026-06-15T16:30:51.596Z", "assignerOrgId": "2cfc7547-56a0-4049-8b52-c3078e8a8719", "datePublished": "2026-09-28T15:45:21.242Z", "assignerShortName": "SailPoint"}, "dataVersion": "5.2"}