Attack Chain

1. An attacker authenticates to IdentityIQ with a user account.
2. The user account has been assigned the "Debug Pages Read Only" capability, or a custom capability including "ViewAccessDebugPage SPRight".
3. The attacker accesses a debug page within IdentityIQ.
4. The attacker leverages the debug page's functionality to craft a request to create a new IdentityIQ object. This could involve manipulating parameters or exploiting unintended functionality of the debug page.
5. IdentityIQ processes the attacker's request without proper authorization checks due to the insufficient access controls on the debug pages.
6. A new IdentityIQ object is created based on the attacker's specifications.
7. The attacker can now potentially manipulate the newly created object.

Impact

Successful exploitation of CVE-2026-4857 allows authenticated users with limited privileges to create new IdentityIQ objects. This could lead to privilege escalation, data manipulation, or denial-of-service depending on the type of object created and the attacker's subsequent actions. Given the high CVSS score of 8.4, organizations using vulnerable IdentityIQ versions are at significant risk. The impact is especially severe if attackers can create administrative or privileged objects.

Recommendation

• Immediately unassign the "Debug Pages Read Only" capability and any custom capabilities containing the "ViewAccessDebugPage SPRight" from all identities and workgroups as outlined in the vulnerability description.
• Upgrade to IdentityIQ 8.5p2 or 8.4p4, or apply the remediating security fix provided by the vendor to address CVE-2026-4857.
• Monitor web server logs for access to debug pages by users with the "Debug Pages Read Only" capability to detect potential exploitation attempts, as demonstrated in the provided Sigma rule.