CVE-2026-4857

CVE-2026-4857 is an authenticated privilege escalation vulnerability affecting SailPoint IdentityIQ versions 8.5 (prior to patch 8.5p2) and 8.4 (prior to patch 8.4p4). The flaw allows authenticated users with the Debug Pages Read Only capability or custom capabilities containing the ViewAccessDebugPage SPRight to incorrectly create new IdentityIQ objects beyond their intended permissions. This represents a significant abuse of access control mechanisms within the identity governance platform. The vulnerability carries a CVSS score of 8.4 (HIGH), accessible over the network with low complexity and high privileges required. The attack requires user interaction and can impact system confidentiality, integrity, and availability across connected systems due to its high scope impact. The broad consequence of unauthorized object creation could lead to privilege escalation, data manipulation, and potential lateral movement within the identity management infrastructure. There is currently no evidence of active exploitation in the wild, with an EPSS score of 0.00036 indicating minimal probability of exploitation. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and is inactive on vendor hotlists. Until patches are applied, SailPoint recommends immediately unassigning the affected capabilities from all identities and workgroups to mitigate risk.