IGA identity CVEs
Identity governance is where joiner-mover-leaver actually happens. A CVSS 10 on IdentityIQ or a role-edit authz hole is a path to every entitlement, not a web-app finding.
How this protocol fails
SailPoint IdentityIQ shipped a CVSS 10.0 static-content traversal (Dec 2024), XSS on the admin console (2025), and a role-editing authorization flaw on all versions (Apr 2026). ISC had access-control, connector path traversal, and transform-template RCE in 2024. Roles are access. An authorization hole on role edit looks like a legitimate change in the audit trail.
What security people should do
- Apply SailPoint e-fixes by train. "We are on 8.4" is not the same as "we took the e-fix."
- Take IdentityIQ off the internet. Put it behind SSO and an admin jump path.
- Diff roles and entitlements around each disclosure window. A new privileged role with no change-request is the hunt.
- Restrict who can edit transforms and connectors in ISC. That is code execution on the IGA plane.
CVEs in this category
Showing 5 of 5
- CVE-2026-5712highSailPoint IdentityIQ role-editing authorization flawSailPoint IdentityIQ · SailPoint · 2026-04-08 · Patched
IdentityIQ failed to authorize role edits on all versions at disclosure (April 2026). Anyone who could reach the role-editing surface could change roles they should not.
- CVE-2025-10280high 7.1SailPoint IdentityIQ content-type XSSSailPoint IdentityIQ · SailPoint · 2025-11-05 · Patched
IdentityIQ reflected script through an incorrect content-type (CWE-79). CVSS 7.1. November 2025. An XSS on an IGA console is an admin-session theft.
- CVE-2024-10905critical 10.0SailPoint IdentityIQ directory traversal, CVSS 10.0SailPoint IdentityIQ · SailPoint · 2024-12-16 · Patched
IdentityIQ exposed protected static content through improper access control and directory traversal. CVSS 10.0. Disclosed December 2024. e-fixes for 8.2p8, 8.3p5, 8.4p2. Still in every 2025 IGA review.
- CVE-2024-3319criticalSailPoint ISC RCE via transform templatesSailPoint Identity Security Cloud · SailPoint · 2024-04-10 · Patched
Identity Security Cloud transform templates could be turned into remote code execution. Same class as Conjur's Ruby template injection, on the SaaS IGA side.
- CVE-2024-3317highSailPoint Identity Security Cloud access-control flawSailPoint Identity Security Cloud · SailPoint · 2024-04-10 · Patched
Identity Security Cloud (ISC) failed an access-control check. One of three 2024 ISC CVEs (3317/3318/3319) that still shape how we talk about SaaS IGA risk in 2025-2026.