CVE-2026-12342CWE-20

CVE-2026-12342

Critical · published September 28, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

This vulnerability

impacts all versions of IdentityIQ and allows an unauthenticated user remote

code execution on the IdentityIQ server due to improper input validation of

submitted web service API content.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00193 · 8.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-09-28T20:17Z
References (1)
https://www.sailpoint.com/security-advisories/ · [email protected]
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 28 SEP 15:45Z
    SailPoint IdentityIQ Improper Form Validation Vulnerability
    cvelistv5