Read the docs

SailPoint

Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

SailPoint records in CISA KEV

No SailPoint vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Identityiq 10 records MEDIUM Desktop Password Reset 1 record LOW

Records

10 records in Identityiq · all components

TI-2024-10109 CVE-2024-10905 · GHSA-9jcj-c3px-4jc5

IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability

Priority MEDIUM 51

IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to st…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00948 Published 2024-12-02 Fixed in 8.2p8, 8.3p5 +1 CWE-66
TI-2024-02067 CVE-2024-2227 · GHSA-84w8-jv98-6r25

IdentityIQ JavaServer Faces File Path Traversal Vulnerability

Priority MEDIUM 50

This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0078 Published 2024-03-22 Fixed in 8.1p7, 8.2p7 +2 CWE-22
TI-2026-10606 CVE-2026-12341 · GHSA-7mfg-3gc5-q3w2

SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability

Priority MEDIUM 43

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00396 Published 2026-07-20 No fix listed CWE-287
TI-2023-15516 CVE-2023-32217 · GHSA-hq36-j573-g8vp

SailPoint IdentityIQ Unsafe use of Reflection Vulnerability

Priority MEDIUM 42

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00628 Published 2023-05-31 No fix listed CWE-470
TI-2022-23181 CVE-2022-46835 · GHSA-rhj5-wv7v-f365

SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability

Priority MEDIUM 42

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00935 Published 2023-01-31 No fix listed CWE-22
TI-2026-05010 CVE-2026-5712 · GHSA-77mr-jp79-jwp3

IdentityIQ Role Editor Incorrect Authorization Vulnerability

Priority LOW 39

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that woul…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00163 Published 2026-04-29 Fixed in 8.5p2, 8.4p4 +1 CWE-863
TI-2024-02068 CVE-2024-2228 · GHSA-wv97-q48c-w5m2

IdentityIQ Authorization of QuickLink Target Identities Vulnerability

Priority LOW 38

This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside of the defined QuickLink Population.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00387 Published 2024-03-22 Fixed in 8.1p7, 8.2p7 +2 CWE-269
TI-2025-09435 CVE-2025-10280 · GHSA-799h-grwr-q8wh

Incorrect Content Type Cross-Site Scripting Vulnerability

Priority LOW 33

IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to…

CVSS 3.1HIGH 7.1 Network Low privileges User interaction EPSS 0.00218 Published 2025-11-03 Fixed in 8.4p4 CWE-79
TI-2022-22401 CVE-2022-45435 · GHSA-hp2j-x7vv-r597

SailPoint IdentityIQ Access Control Bypass

Priority LOW 32

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0…

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00392 Published 2023-01-31 No fix listed CWE-863
TI-2024-01594 CVE-2024-1714 · GHSA-x5qv-8w36-gxh4

Access Request for Entitlement Values with Leading/Trailing Whitespace

Priority LOW 31

An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access reques…

CVSS 3.1HIGH 7.1 Network Low privileges User interaction EPSS 0.00344 Published 2024-02-21 Fixed in 8.2p7, 8.3p4 +1 CWE-20
Open these records in search →