CVE-2024-3318SailPoint ISC connector path traversal
What broke
An ISC connector accepted a path it should have rejected and read or wrote outside the intended file set. SailPoint patched. This is the closest thing the 2025-2026 window had to a SCIM / provisioning CVE: not the protocol, the connector.
Why it matters
Provisioning connectors hold service credentials to AD, Entra, HR, and SaaS. A path traversal there is how an IGA admin (or an attacker who became one) reads those credentials off disk.
What to do
- Confirm the ISC connector fix in your tenant.
- Rotate connector service accounts. Treat them as tier-zero.
- Do not let custom connector code read arbitrary paths "for debugging."
After you patch
Provisioning interfaces create and modify accounts, so a flaw here is an account-creation primitive rather than a data leak.
- Rotate the SCIM bearer token or client credential used by the identity provider.
- Reconcile provisioned accounts against the authoritative source and remove anything with no matching identity. See orphaned account.
- Review group membership changes applied through the connector during the window.
- Confirm deactivation semantics: verify that
active: falseactually removes access in the target application rather than soft-deleting a still-usable account. See SCIM 2.0.
Sources
Related identity CVEs
Related on Start with Identity
- CVESailPoint Identity Security Cloud access-control flaw
Identity Security Cloud (ISC) failed an access-control check. One of three 2024 ISC CVEs (3317/3318/3319) that still shape how we talk about SaaS IGA risk in 20
- CVESailPoint ISC RCE via transform templates
Identity Security Cloud transform templates could be turned into remote code execution. Same class as Conjur's Ruby template injection, on the SaaS IGA side.
- CVESailPoint IdentityIQ content-type XSS
IdentityIQ reflected script through an incorrect content-type (CWE-79). CVSS 7.1. November 2025. An XSS on an IGA console is an admin-session theft.
- GlossaryProvisioning
Creating user accounts and entitlements in target systems. Modern provisioning is automated via SCIM or vendor APIs, triggered by HR system events. Manual provi
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- VendorAkamai Identity Cloud
niche