CVE-2024-10905

9.8 criticalEPSS 0.9%

Critical (9.8) in sailpoint identityiq. EPSS 0.9% chance of exploitation in the next 30 days.

IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWE: CWE-66
Published: 2024-12-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sailpoint:identityiq

References

https://www.sailpoint.com/security-advisories/identityiq-improper-access-control-vulnerability-cve-2024-10905

Check your stack JSON