Vulnerability · Published Aug 10, 2026 · Assigned by Ping Identity
CVE-2025-32736PingFederate Administrative Console CSRF weaknesses
Medium 4.9
In plain English
A medium-severity cross-site request forgery in PingFederate from Ping Identity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 4.0)4.9Medium
Exploit odds (30 days)0.2%top 88.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ping Identity | PingFederate | 10.0 – before 13.1 |
Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L/E:P