Is CVE-2026-12341 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12341 being exploited in the wild.

How severe is CVE-2026-12341?

High severity, with a CVSS score of 8.8, published 20 July 2026.

Which products and versions are affected?

SailPoint IdentityIQ All versions (including 8.3p5, 8.4p4, 8.5p1 and earlier).

Is there a fix for CVE-2026-12341?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12341 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12341?

Check whether you run SailPoint IdentityIQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12341: SailPoint IdentityIQ improper authentication in OAuth token validation

CVE-2026-12341 · Severity: high · CVSS 8.8 · Published 2026-07-20

SailPoint IdentityIQ, a platform used by organizations to manage user identities and access permissions, contains a security flaw that allows unauthorized individuals to access sensitive data. An attacker can bypass security checks to reach protected application interfaces without needing a username or password. This could lead to the exposure of confidential corporate identity data or unauthorized changes to user access rights.

Technologies: SailPoint IdentityIQ. Vendors: SailPoint.

Quick answers

Is CVE-2026-12341 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12341 being exploited in the wild.
How severe is CVE-2026-12341?: High severity, with a CVSS score of 8.8, published 20 July 2026.
Which products and versions are affected?: SailPoint IdentityIQ All versions (including 8.3p5, 8.4p4, 8.5p1 and earlier).
Is there a fix for CVE-2026-12341?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12341 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12341?: Check whether you run SailPoint IdentityIQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in SailPoint IdentityIQ stems from improper authentication (CWE-287) due to the incorrect validation of OAuth bearer tokens. An unauthenticated remote attacker can exploit this flaw to gain unauthorized access to protected APIs and sensitive data. The attack vector is network-based and requires no prior privileges, though the CVSS vector suggests some level of user interaction may be involved. All versions of IdentityIQ are reported as affected, including the 8.3, 8.4, and 8.5 release branches.

Affected products

SailPoint Technologies IdentityIQ All versions (including 8.3p5, 8.4p4, 8.5p1 and earlier)

Timeline

2026-07-20: disclosed
2026-07-20: advisory

References

https://www.sailpoint.com/security-advisories/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.