Vulnerability · Published Sep 14, 2026 · Assigned by Ping Identity
CVE-2026-20773Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint
High 8.5
In plain English
A high-severity incorrect authorization in PingFederate from Ping Identity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 4.0)8.5High
Exploit odds (30 days)0.4%top 71.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ping Identity | PingFederate | 13.0.0 – through 13.0.112.3.0 – through 12.3.512.2.0 – through 12.2.712.1.0 – through 12.1.1012.0.0 – through 12.0.1011.3.0 – through 11.3.14 |
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H