What is the CVSS score of CVE-2026-12341?

CVE-2026-12341 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of SailPoint IdentityIQ are affected by CVE-2026-12341?

SailPoint IdentityIQ suffers a critical authentication bypass that permits unauthenticated attackers to access identity governance APIs and underlying user/role data through improperly validated…

How to fix or mitigate CVE-2026-12341?

Within 24 hours, inventory all SailPoint IdentityIQ deployments to identify affected versions and network exposure; implement network-level restrictions to IdentityIQ API endpoints allowing only trusted internal IP ranges or VPN access, and enable detailed logging of OAuth token validation failures and API requests. Within 7 days, apply all hardening guidance from SailPoint's security advisory including disabling non-essential OAuth endpoints, implementing API rate-limiting, and conducting forensic log review for unauthorized access attempts. Within 30 days, establish a pre-production test environment with the same IdentityIQ version configuration to validate the vendor patch when released, then execute staged production deployment starting with non-critical systems to minimize business disruption.

SailPoint IdentityIQ CVE-2026-12341

EUVD-2026-46064 CRITICAL

Improper Authentication (CWE-287)

2026-07-20 SailPoint

GHSA-7mfg-3gc5-q3w2

Authentication Bypass Identityiq Sailpoint Technologies

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (SailPoint) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable API with improper token validation gives PR:N/AV:N/AC:L, and total technical impact on an identity platform justifies C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (SailPoint).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 16:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 16:52 vuln.today

cvss_changed

Severity Changed

Jul 30, 2026 - 16:52 NVD

HIGH CRITICAL

CVSS changed

Jul 30, 2026 - 16:52 NVD

8.8 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 20, 2026 - 19:23 vuln.today

CVE Published

Jul 20, 2026 - 18:22 cve.org

HIGH 8.8

DescriptionNVD

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.

AnalysisAI

Authentication bypass in SailPoint IdentityIQ lets an unauthenticated remote attacker reach protected APIs and data because OAuth bearer tokens are improperly validated. The flaw (CWE-287) affects all IdentityIQ versions up to the patched releases 8.5p1, 8.4p4, and 8.3p5, and carries a critical CVSS of 9.8. No public exploit identified at time of analysis and EPSS is low (0.22%), but the total technical impact against an identity-governance platform makes it a high-priority patch.

Technical ContextAI

IdentityIQ is SailPoint's on-premises identity governance and administration (IGA) platform that centralizes user provisioning, access certification, and policy enforcement across an enterprise. It exposes REST/OAuth-protected APIs where bearer tokens are supposed to authenticate and authorize callers. The root cause maps to CWE-287 (Improper Authentication): the token-validation logic does not correctly verify OAuth bearer tokens, so the trust boundary that gates the protected APIs can be crossed without a legitimate, properly validated credential. Because IdentityIQ brokers access to many downstream systems and holds sensitive identity data, a break in its own API authentication is especially consequential.

RemediationAI

Upgrade to a patched IdentityIQ release beyond the vulnerable levels - SailPoint's advisory indicates fixes at or above 8.5p1, 8.4p4, and 8.3p5 for their respective branches; confirm the exact target patch for your branch against the vendor advisory at https://www.sailpoint.com/security-advisories/ and do not run a version at or below your branch's listed vulnerable level. Because the root cause is broken OAuth bearer-token validation and the description says all versions are impacted, treat patching as the primary control. Until patched, restrict network reachability of the IdentityIQ API endpoints to trusted management networks or a VPN, place the application behind a reverse proxy or WAF that enforces its own authentication in front of the protected API paths, and closely monitor API access logs for anomalous or unauthenticated token use - with the trade-off that proxy-enforced auth can break legitimate integrations and API clients that rely on IdentityIQ's own OAuth flow, so test integrations before enforcing. No independent confirmation of a standalone vendor workaround is available; the advisory URL is the authoritative source.