CVE-2026-4857highCWE-863

CVE-2026-4857: high-severity vulnerability in SailPoint Technologies IdentityIQ

SailPoint IdentityIQ Debug UI Incorrect Authorization

Published · Updated

Follow this CVE+ Monitor IdentityIQ

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.4epss 0.3%
IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug Pages Read Only capability or any custom capability with the ViewAccessDebugPage SPRight to incorrectly create new IdentityIQ objects.  Until a remediating security fix or patches containing this security fix are installed, the Debug Pages Read Only capability and any custom capabilities that contain the ViewAccessDebugPage SPRight should be unassigned from all identities and workgroups.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected products
SailPoint Technologies · IdentityIQ
Related CVEs — SailPoint Technologies IdentityIQ

In the same product, most dangerous first.

CVE-2024-10905CRITICALIdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control VulnerabilityEPSS 0.9%CVE-2026-12341HIGHSailPoint IdentityIQ Improper Bearer Token Validation VulnerabilityEPSS 0.4%CVE-2025-10280HIGHIncorrect Content Type Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2026-12342CRITICALSailPoint IdentityIQ Improper Form Validation VulnerabilityEPSS 0.2%CVE-2026-5712HIGHIdentityIQ Role Editor Incorrect Authorization VulnerabilityEPSS 0.2%