CVE-2026-4857highCWE-863

CVE-2026-4857: falha de alta gravidade em SailPoint Technologies IdentityIQ

SailPoint IdentityIQ Debug UI Incorrect Authorization

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar IdentityIQ

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.4epss 0.3%
IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug Pages Read Only capability or any custom capability with the ViewAccessDebugPage SPRight to incorrectly create new IdentityIQ objects.  Until a remediating security fix or patches containing this security fix are installed, the Debug Pages Read Only capability and any custom capabilities that contain the ViewAccessDebugPage SPRight should be unassigned from all identities and workgroups.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
SailPoint Technologies · IdentityIQ
CVEs relacionadas — SailPoint Technologies IdentityIQ

No mesmo produto, das mais perigosas para as menos.

CVE-2024-10905CRITICALIdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control VulnerabilityEPSS 0.9%CVE-2026-12341HIGHSailPoint IdentityIQ Improper Bearer Token Validation VulnerabilityEPSS 0.4%CVE-2025-10280HIGHIncorrect Content Type Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2026-12342CRITICALSailPoint IdentityIQ Improper Form Validation VulnerabilityEPSS 0.2%CVE-2026-5712HIGHIdentityIQ Role Editor Incorrect Authorization VulnerabilityEPSS 0.2%