by Kastro
Paper/Archive/CVE-2026-12341

CVE-2026-12341

SailPoint Technologies IdentityIQ — SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 33.8.338 × 206.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.

Affected

ProductAffectedFixed inSource
IdentityIQ8.5 – 8.5p1–CNA
IdentityIQ8.4 – 8.4p4–CNA
IdentityIQ8.3 – 8.3p5–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SailPoint (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsailpoint.com/security-advisories