Ping Identity vulnerabilities

CVEs per yearBy the year they were published

1. 20213
2. 202215
3. 202311
4. 202412
5. 20256
6. 20266

Newest CVEs

• CVE-2026-80327

  Open Redirect in PingGateway Fragment Filter

  Ping Identity · PingGateway

  Medium5.1
• CVE-2026-21391

  Improper Claim Validation in PingAM OIDC Provider

  Ping Identity · PingAM

  Critical9.5
• CVE-2026-20773

  Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint

  Ping Identity · PingFederate

  High8.5
• CVE-2025-32736

  PingFederate Administrative Console CSRF weaknesses

  Ping Identity · PingFederate

  Medium4.9
• CVE-2026-20746

  PingDirectory copying of virtual attributes leads to memory exhaustion

  Ping Identity · PingDirectory

  Medium6.3
• CVE-2025-20628

  Insufficient granularity of access control for Remote Connector Servers in client mode

  Ping Identity · PingIDM

  Medium6.9
• CVE-2025-27935

  Authentication Bypass in OTP (One-time Passcode) IdP Adapter Integration Kit

  Ping Identity · One-Time Passcode Integration Kit for PingFederate

  High8.6
• CVE-2025-26862

  PingFederate unexpected browser flow initiation in redirectless mode

  Ping Identity · PingFederate

  None0.0
• CVE-2024-25573

  Stored Cross-Site Scripting in Administrative Console Context

  Ping Identity · PingFederate

  Medium6.9
• CVE-2025-22854

  Possible thread exhaustion from processing http responses in PingFederate Google Adapter

  Ping Identity · PingFederate

  Medium6.9