CVE-2026-4857 SailPoint Technologies CVE debrief

Who should care

Defenders and administrators of IdentityIQ systems should assess exposure and prioritize mitigation. Specifically, those with the Debug Pages Read Only capability or custom capabilities with the ViewAccessDebugPage SPRight should be evaluated for potential impact.

Why it matters

This vulnerability allows authenticated users to create new IdentityIQ objects, potentially disrupting identity management processes. Defenders should prioritize patching, verify affected systems, and mitigate the vulnerability to prevent unauthorized object creation.

• Potential creation of unauthorized IdentityIQ objects by authenticated users.
• Possible disruption to identity management processes.
• Need for verification of affected systems and patch levels.
• Priority on applying patches or mitigating the vulnerability.

Technical summary

The vulnerability exists in IdentityIQ 8.5 and 8.4, with patch levels prior to 8.5p2 and 8.4p4 being affected. Authenticated users with the Debug Pages Read Only capability or custom capabilities containing the ViewAccessDebugPage SPRight can create new IdentityIQ objects. This authorization issue allows for potential disruption to identity management processes, emphasizing the need for defenders to assess exposure and prioritize mitigation. The issue can be mitigated by unassigning affected capabilities until patches are applied.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where authenticated users have the Debug Pages Read Only capability or custom capabilities with the ViewAccessDebugPage SPRight.

Recommended defensive actions

• Review and remove the Debug Pages Read Only capability from all identities and workgroups.
• Review and remove custom capabilities with the ViewAccessDebugPage SPRight from all identities and workgroups.
• Apply patches or security fixes when available.
• Verify the scope of affected systems and prioritize patching accordingly.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the exact scope of affected systems and the availability of patches require verification from official sources. Defenders should verify the scope of affected IdentityIQ systems, especially those with patch levels prior to 8.5p2 and 8.4p4, and confirm the applicability of patches or security fixes. This includes reviewing system configurations, user capabilities, and patch deployment status.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.