Medium severity · published Jun 12, 2026
CVE-2026-20746
PingDirectory copying of virtual attributes leads to memory exhaustion
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
PingDirectory · Ping Identity
9.3.0.0 through 9.3.0.8; 10.1.0.0 through 10.1.0.5; 10.2.0.0 through 10.2.0.5; 10.3.0.0 through 10.3.0.3; 11.0.0.0 before 11.0.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-20746
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-20746
docs.pingidentity.com
https://docs.pingidentity.com/pingdirectory/11.0/release_notes/pd_release_notes.html#pingdirectory-suite-of-products-11-0-0-1-march-2026
support.pingidentity.com
https://support.pingidentity.com/s/article/SECADV052-Denial-of-Service-via-copying-virtual-attributes
www.pingidentity.com
https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html
More from PingDirectory
8.8
CVE-2023-36496
Delegated Admin Virtual Attribute Provider Privilege Escalation