CVE-2026-12341
Full vulnerability record from the local CVENow database.
Description
This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.
Severity
CRITICAL
CVSS score
9.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-20 19:17:18.027000
Last modified
2026-10-24 20:10:00.137000
View original CVE JSON
{
"id": "CVE-2026-12341",
"sourceIdentifier": "[email protected]",
"published": "2026-07-20T19:17:18.027",
"lastModified": "2026-10-24T20:10:00.137",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "This vulnerability\nimpacts all versions of IdentityIQ and allows an unauthenticated attacker\nunauthorized access to protected APIs and data due to improper validation of\nOAuth bearer tokens."
},
{
"lang": "es",
"value": "Esta vulnerabilidad impacta a todas las versiones de IdentityIQ y permite a un atacante no autenticado acceso no autorizado a APIs y datos protegidos debido a una validación incorrecta de tokens portadores de OAuth."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "SailPoint Technologies",
"product": "IdentityIQ",
"defaultStatus": "affected",
"versions": [
{
"version": "8.5",
"lessThanOrEqual": "8.5p1",
"versionType": "custom",
"status": "affected"
},
{
"version": "8.4",
"lessThanOrEqual": "8.4p4",
"versionType": "custom",
"status": "affected"
},
{
"version": "8.3",
"lessThanOrEqual": "8.3p5",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-21T12:32:24.269697Z",
"id": "CVE-2026-12341",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.3",
"matchCriteriaId": "B7992F80-093D-4277-9AA8-5438ABFBF83B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:-:*:*:*:*:*:*",
"matchCriteriaId": "1173CC53-CBE5-450C-96BF-8583D1B3D185"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch1:*:*:*:*:*:*",
"matchCriteriaId": "2C0F5E55-5D33-425F-9DA7-49FE66CD84C4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch2:*:*:*:*:*:*",
"matchCriteriaId": "1A2FD228-E6DB-49E3-BE3E-1BF9B0434FC0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch3:*:*:*:*:*:*",
"matchCriteriaId": "074A8B45-9D38-4094-9999-48FC0F055E0A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch4:*:*:*:*:*:*",
"matchCriteriaId": "0652D99D-DC1E-4E22-8E7D-AE080494C50B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch5:*:*:*:*:*:*",
"matchCriteriaId": "D7964011-B0F1-4F07-8C14-6EEA0B421F80"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.4:-:*:*:*:*:*:*",
"matchCriteriaId": "4BC4F08D-A3FB-41F6-8EFD-6F34FBC0F75F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.4:patch1:*:*:*:*:*:*",
"matchCriteriaId": "4ECFADA6-BB7B-4228-9434-B92B2FF21481"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.4:patch2:*:*:*:*:*:*",
"matchCriteriaId": "A39B1317-37C0-49DA-9207-7B7CBE6EC190"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.4:patch3:*:*:*:*:*:*",
"matchCriteriaId": "56315AF4-C19E-4910-BD13-FEC725F77E4B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.4:patch4:*:*:*:*:*:*",
"matchCriteriaId": "3A1E42DA-BD81-4CE8-921B-0E5891E65085"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.5:-:*:*:*:*:*:*",
"matchCriteriaId": "01FF7480-9CBA-4283-994C-B2586C2F5F54"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.5:patch1:*:*:*:*:*:*",
"matchCriteriaId": "5E0FF783-DAF2-4DDA-A263-DB51101ACAD6"
}
]
}
]
}
],
"references": [
{
"url": "https://www.sailpoint.com/security-advisories/",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}