SailPoint IdentityIQ CVE-2026-12342

Requires network reachability to the IdentityIQ web service API endpoint; per the vendor CVSS vector this is Adjacent (AV:A), i.e. the attacker must be on the same/adjacent network segment rather than the open internet - this is the primary limiting factor. No authentication (PR:N) and no user interaction (UI:N) are needed, and exploitation is low-complexity (AC:L). All versions of IdentityIQ are stated to be affected, so no specific version or non-default configuration is required; the only established prerequisite is the ability to submit content to the vulnerable API. Note the description characterizes this as 'remote,' which is in tension with the vendor's Adjacent rating and should be verified against the SailPoint advisory.

This is a high-priority issue on signal-alignment: the vendor (SailPoint) CVSS 3.1 vector rates it 9.6 critical, driven by PR:N (unauthenticated), AC:L (low complexity), UI:N (no user interaction), and full C:H/I:H/A:H impact culminating in remote code execution - the worst-case outcome for an enterprise identity governance server. The one signal that tempers raw severity is AV:A (Adjacent), not AV:N: the vendor asserts the attacker must be on an adjacent/local network segment rather than the open internet, which materially narrows the exposed attack surface versus a typical internet-facing RCE. This conflicts with the plain-language description, which says 'remote code execution' via 'submitted web service API content' and reads like a network-reachable endpoint - the AV:A vs 'remote'/web-API tension should be verified against the SailPoint advisory. Exploitation-probability signals are all absent: no EPSS score, not on CISA KEV, and no public POC identified at time of analysis, so there is no evidence of active exploitation yet - but IdentityIQ is a high-value IAM target and 'all versions affected' plus unauthenticated + low-complexity make this attractive to weaponize once details surface. Net: treat as an urgent patch/mitigation priority for anyone running IdentityIQ, while confirming whether the adjacent-network constraint holds in your deployment.

An attacker with access to the network segment where IdentityIQ is reachable sends crafted content to the vulnerable web service API endpoint, which fails to validate the input (CWE-20), and achieves unauthenticated remote code execution on the IdentityIQ server. No credentials or user interaction are required (PR:N/UI:N, AC:L). No public exploit code has been identified at time of analysis, but the vendor notes the adjacent-network attack vector (AV:A) as the main limiting factor.