CVE-2026-4857

HighCVSS 8.4/10Last modified Oct 26, 2026

Description

IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug Pages Read Only capability or any custom capability with the ViewAccessDebugPage SPRight to incorrectly create new IdentityIQ objects.  Until a remediating security fix or patches containing this security fix are installed, the Debug Pages Read Only capability and any custom capabilities that contain the ViewAccessDebugPage SPRight should be unassigned from all identities and workgroups.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
SailPoint TechnologiesIdentityIQ>= 8.5, < 8.5p2; >= 8.4, < 8.4p4

References

Timeline

Published
Apr 15, 2026
Last modified
Oct 26, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-485707.9Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-485717.0Use after free in Windows App Installer allows an authorized attacker to elevate privileges locally.CVE-2026-485727.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized atCVE-2026-485737.9No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-485747.8Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.CVE-2026-485757.9Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-485767.9No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-485787.9Improper access control in Windows Secure Boot allows an authorized attacker to elevate privileges locally.CVE-2026-485797.5Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.CVE-2026-48589.9Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversCVE-2026-485805.5Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-485817.8Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.
CVE-2026-4857: High severity, CVSS 8.4 | Vulnix