Sailpoint vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Sailpoint products: 3 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-12341 Critical · 9.8 CWE-287 Jul 20, 2026

SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.

CVE-2026-5712 High · 8.8 CWE-863 Apr 29, 2026

IdentityIQ Role Editor Incorrect Authorization Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.

CVE-2025-10280 Medium · 6.1 CWE-79 Nov 3, 2025

Incorrect Content Type Cross-Site Scripting Vulnerability

IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via a URL path that will set the Content-Type to HTML allowing a requesting browser to interpret content not properly escaped to prevent Cross-Site Scripting (XSS).