CVE-2026-12341

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.sailpoint.com/security-advisories/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sailpoint:identityiq::::::::
	cpe:2.3:a:sailpoint:identityiq:8.3:-::::::
	cpe:2.3:a:sailpoint:identityiq:8.3:patch1::::::
	cpe:2.3:a:sailpoint:identityiq:8.3:patch2::::::
	cpe:2.3:a:sailpoint:identityiq:8.3:patch3::::::
	cpe:2.3:a:sailpoint:identityiq:8.3:patch4::::::
	cpe:2.3:a:sailpoint:identityiq:8.3:patch5::::::
	cpe:2.3:a:sailpoint:identityiq:8.4:-::::::
	cpe:2.3:a:sailpoint:identityiq:8.4:patch1::::::
	cpe:2.3:a:sailpoint:identityiq:8.4:patch2::::::
	cpe:2.3:a:sailpoint:identityiq:8.4:patch3::::::
	cpe:2.3:a:sailpoint:identityiq:8.4:patch4::::::
	cpe:2.3:a:sailpoint:identityiq:8.5:-::::::
	cpe:2.3:a:sailpoint:identityiq:8.5:patch1::::::

History

No history.

Information

Published : 2026-07-20 19:17

Updated : 2026-07-30 16:40

NVD link : CVE-2026-12341

Mitre link : CVE-2026-12341

CVE.ORG link : CVE-2026-12341

JSON object : View

Products Affected

sailpoint

identityiq

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-12341", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12341", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-21T12:32:24.269697Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@sailpoint.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@sailpoint.com", "affectedData": [{"vendor": "SailPoint Technologies", "product": "IdentityIQ", "versions": [{"status": "affected", "version": "8.5", "versionType": "custom", "lessThanOrEqual": "8.5p1"}, {"status": "affected", "version": "8.4", "versionType": "custom", "lessThanOrEqual": "8.4p4"}, {"status": "affected", "version": "8.3", "versionType": "custom", "lessThanOrEqual": "8.3p5"}], "defaultStatus": "affected"}]}], "published": "2026-07-20T19:17:18.027", "references": [{"url": "https://www.sailpoint.com/security-advisories/", "tags": ["Vendor Advisory"], "source": "psirt@sailpoint.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@sailpoint.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability\nimpacts all versions of IdentityIQ and allows an unauthenticated attacker\nunauthorized access to protected APIs and data due to improper validation of\nOAuth bearer tokens."}], "lastModified": "2026-07-30T16:40:45.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sailpoint:identityiq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7992F80-093D-4277-9AA8-5438ABFBF83B", "versionEndExcluding": "8.3"}, {"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1173CC53-CBE5-450C-96BF-8583D1B3D185"}, {"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C0F5E55-5D33-425F-9DA7-49FE66CD84C4"}, {"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A2FD228-E6DB-49E3-BE3E-1BF9B0434FC0"}, {"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "074A8B45-9D38-4094-9999-48FC0F055E0A"}, {"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0652D99D-DC1E-4E22-8E7D-AE080494C50B"}, {"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7964011-B0F1-4F07-8C14-6EEA0B421F80"}, {"criteria": "cpe:2.3:a:sailpoint:identityiq:8.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BC4F08D-A3FB-41F6-8EFD-6F34FBC0F75F"}, {"criteria": "cpe:2.3:a:sailpoint:identityiq:8.4:patch1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4ECFADA6-BB7B-4228-9434-B92B2FF21481"}, {"criteria": "cpe:2.3:a:sailpoint:identityiq:8.4:patch2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A39B1317-37C0-49DA-9207-7B7CBE6EC190"}, {"criteria": "cpe:2.3:a:sailpoint:identityiq:8.4:patch3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56315AF4-C19E-4910-BD13-FEC725F77E4B"}, {"criteria": "cpe:2.3:a:sailpoint:identityiq:8.4:patch4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A1E42DA-BD81-4CE8-921B-0E5891E65085"}, {"criteria": "cpe:2.3:a:sailpoint:identityiq:8.5:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01FF7480-9CBA-4283-994C-B2586C2F5F54"}, {"criteria": "cpe:2.3:a:sailpoint:identityiq:8.5:patch1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E0FF783-DAF2-4DDA-A263-DB51101ACAD6"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@sailpoint.com"}