What’s Vulnerable › Vulnerabilities
CVE-2026-20773: Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint
- Severity: high (CVSS 8.5 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-14 · updated 2026-09-18
- Weakness: CWE-863
Description
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.
Affected products
- Ping Identity PingFederate: from 13.0.0 through 13.0.1; from 12.3.0 through 12.3.5; from 12.2.0 through 12.2.7; from 12.1.0 through 12.1.10; from 12.0.0 through 12.0.10; from 11.3.0 through 11.3.14
References
Get alerted when CVE-2026-20773 or the next vulnerability affects your stack