CVE-2026-4857highCWE-863

CVE-2026-4857: fallo de gravedad alta en SailPoint Technologies IdentityIQ

SailPoint IdentityIQ Debug UI Incorrect Authorization

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear IdentityIQ

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.4epss 0.3%
IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug Pages Read Only capability or any custom capability with the ViewAccessDebugPage SPRight to incorrectly create new IdentityIQ objects.  Until a remediating security fix or patches containing this security fix are installed, the Debug Pages Read Only capability and any custom capabilities that contain the ViewAccessDebugPage SPRight should be unassigned from all identities and workgroups.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Productos afectados
SailPoint Technologies · IdentityIQ
CVEs relacionadas — SailPoint Technologies IdentityIQ

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-10905CRITICALIdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control VulnerabilityEPSS 0.9%CVE-2026-12341HIGHSailPoint IdentityIQ Improper Bearer Token Validation VulnerabilityEPSS 0.4%CVE-2025-10280HIGHIncorrect Content Type Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2026-12342CRITICALSailPoint IdentityIQ Improper Form Validation VulnerabilityEPSS 0.2%CVE-2026-5712HIGHIdentityIQ Role Editor Incorrect Authorization VulnerabilityEPSS 0.2%