Skip to content
OpenAdvisories

Product · SailPoint

IdentityIQ

12 known vulnerabilities.

IdentityIQ at a glance

Last 12 months
4
Critical · all time
4
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 2 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability August 2026: 0 vulnerabilities September 2026: 1 vulnerability, 1 critical Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202611
Aug 202600
Jul 202610
Jun 202600
May 202600
Apr 202620
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202510
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202411
All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • Critical 9.6
    CVE-2026-12342

    SailPoint IdentityIQ Improper Form Validation Vulnerability

    This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.

    SailPoint IdentityIQ
  • High 8.8
    CVE-2026-12341

    SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability

    This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.

    SailPoint IdentityIQ
  • High 8.0
    CVE-2026-5712

    IdentityIQ Role Editor Incorrect Authorization Vulnerability

    This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.

    SailPoint IdentityIQ
  • High 8.4
    CVE-2026-4857

    SailPoint IdentityIQ Debug UI Incorrect Authorization

    IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug Pages Read Only capability or any custom capability with the ViewAccessDebugPage SP…

    SailPoint IdentityIQ
  • High 7.1
    CVE-2025-10280

    Incorrect Content Type Cross-Site Scripting Vulnerability

    IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via a URL path that will s…

    SailPoint IdentityIQ
  • Critical 10.0
    CVE-2024-10905

    IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability

    IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ applicat…

    SailPoint IdentityIQ
  • High 7.1
    CVE-2024-2228

    IdentityIQ Authorization of QuickLink Target Identities Vulnerability

    This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside of the defined QuickLink Population.

    SailPoint IdentityIQ
  • Critical 10.0
    CVE-2024-2227

    IdentityIQ JavaServer Faces File Path Traversal Vulnerability

    This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix…

    SailPoint IdentityIQ
  • High 7.1
    CVE-2024-1714

    Access Request for Entitlement Values with Leading/Trailing Whitespace

    An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request.

    SailPoint IdentityIQ
  • Critical 9.0
    CVE-2023-32217

    SailPoint IdentityIQ Unsafe use of Reflection Vulnerability

    IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invok…

    SailPoint IdentityIQ
  • High 8.8
    CVE-2022-46835

    SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability

    IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in t…

    SailPoint IdentityIQ
  • Medium 6.8
    CVE-2022-45435

    SailPoint IdentityIQ Access Control Bypass

    IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authen…

    SailPoint IdentityIQ