SailPoint IdentityIQ unauthenticated RCE via web service API
Improper input validation in IdentityIQ's web service API lets an unauthenticated attacker execute arbitrary code on the server. All versions are affected.
- Vendor
- SailPoint
- Product
- IdentityIQ
- CVSS
- 9.6
- EPSS (exploit probability)
- 0.2%
- Status
- patched
- Published
Is CVE-2026-12342 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-12342 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-15 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.2% (scored November 9, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-15. Full cross-catalog view: /kev-comparison
CVE-2026-12342 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
SailPoint disclosed CVE-2026-12342 in its IdentityIQ identity governance platform. The vulnerability is rooted in insufficient validation of data submitted to the product’s web service API, allowing a remote unauthenticated attacker to execute arbitrary code on the server.
All versions of IdentityIQ are affected. SailPoint has released a patch, documented in the vendor security advisory linked above. Organizations should apply the patch as directed and review network exposure of the IdentityIQ web service API in the interim.
No active exploitation has been confirmed at time of publication.
