---
id: CVE-2026-12342
title: |-
  This vulnerability
  impacts all versions of IdentityIQ and allows an unauthenticated user remote
  code execution on the IdentityIQ server due to improper input validation of
  submitted web service API content.
summary: |-
  This vulnerability
  impacts all versions of IdentityIQ and allows an unauthenticated user remote
  code execution on the IdentityIQ server due to improper input validation of
  submitted web service API content.
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-20
vendor: SailPoint Technologies
product: IdentityIQ
affected:
  - IdentityIQ >= 8.5 <= 8.5p2
  - IdentityIQ >= 8.4 <= 8.4p4
  - IdentityIQ >= 8.3 <= 8.3p5
published: '2026-09-28'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T17:23:08.953'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12342'
references:
  - url: 'https://www.sailpoint.com/security-advisories/'
    label: psirt@sailpoint.com
tags:
  - nvd
  - cve.org
epss: 0.00193
epssPercentile: 0.08846
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-28T16:30:12.176710Z'
ingestedAt: '2026-09-28T16:15:01.369Z'
---

## Overview

This vulnerability
impacts all versions of IdentityIQ and allows an unauthenticated user remote
code execution on the IdentityIQ server due to improper input validation of
submitted web service API content.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.