Start with Identity
Subscribe
Identity CVE · IGA

CVE-2024-10905SailPoint IdentityIQ directory traversal, CVSS 10.0

critical · CVSS 10.0
Product: SailPoint IdentityIQVendor: SailPointDisclosed: 2024-12-16Status: PatchedNVD ↗

What broke

SailPoint IdentityIQ served protected static content through a directory-traversal / access-control gap. CVSS 10.0. Disclosed December 2024. SailPoint shipped e-fixes for 8.2p8, 8.3p5, and 8.4p2.

Why it matters

IGA is where joiner-mover-leaver actually happens. A CVSS 10 on IdentityIQ is not a web-app finding. It is a path to every entitlement model, every SOD rule, and often the service accounts IIQ uses to write to AD. We keep it in this catalog because 2025-2026 assessments still find unpatched 8.2/8.3.

What to do

  • Apply the e-fix for your train. Confirm with SailPoint's advisory, not with "we are on 8.4."
  • Take IdentityIQ off the internet. Put it behind SSO and an admin jump path.
  • Review the 2025-2026 follow-ons: CVE-2025-10280 (XSS) and CVE-2026-5712 (role-editing authz).

After you patch

A governance platform holds connector credentials into most of your estate and can grant access by design, which makes it a high-value target rather than a reporting tool.

  • Rotate every connector credential, since these are typically privileged service accounts in the systems being governed.
  • Review entitlement changes, role assignments, and approvals recorded during the exposure window, and re-verify any that lack a matching request.
  • Revoke sessions and API tokens on the platform itself, and check for administrative accounts added during the window.
  • Re-run certification on privileged entitlements rather than assuming the last campaign is still valid. See access certification and what is IGA.

Sources

Related identity CVEs

Related on Start with Identity

Last reviewed By SWI Community TeamSuggest a correctionHow we research
Know a primary source we should add, or a patch status that has changed? Email community@startwithidentity.com. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.