CVE-2026-20773: Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint

High severity · published Sep 14, 2026

CVE-2026-20773

Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint

8.5

CVSS

0.4%

EPSS

On KEV

Description

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 29% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

PingFederate · Ping Identity

13.0.0 through 13.0.1; 12.3.0 through 12.3.5; 12.2.0 through 12.2.7; 12.1.0 through 12.1.10; 12.0.0 through 12.0.10; 11.3.0 through 11.3.14 · source: vendor

Affected product

PingFederate

Ping Identity

All PingFederate CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-20773

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-20773

support.pingidentity.com

https://support.pingidentity.com/s/article/SECADV054-Improper-Authorization-in-PingFederate-Administrative-Expression-Evaluation-Endpoint