Ping Identity has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 8.5 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.5
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-21391Critical· 9.5An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden52CVE-2026-20773High· 8.5A role-based access control issue was identified in the administrative expression evaluation functionality47CVE-2026-80327Medium· 5.1An open redirect vulnerability exists in the PingGateway Fragment Filter feature28
Ping Identity vulnerabilities
CVEs affecting Ping Identity, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-80327Medium· 5.1An open redirect vulnerability exists in the PingGateway Fragment Filter feature
An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 202…
CVE-2026-20773High· 8.5A role-based access control issue was identified in the administrative expression evaluation functionality
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissi…
CVE-2026-21391Critical· 9.5An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden
An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication…