PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-20773 Ping Identity CVE debrief

A role-based access control issue was identified in the administrative expression evaluation functionality of PingFederate. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions. The issue affects PingFederate deployments, where defenders should assess exposure and verify administrative role access to the affected functionality. The vulnerability has a CVSS score of 8.5 and is considered HIGH severity. Defenders should prioritize verifying and limiting administrative role access to the affected functionality.

Vendor
Ping Identity
Product
PingFederate
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-14
Original CVE updated
2026-09-18
Advisory published
2026-09-14
Advisory updated
2026-09-18

Who should care

Defenders responsible for PingFederate deployments should assess exposure and verify administrative role access to the affected functionality.

Why it matters

A role-based access control issue in PingFederate's administrative expression evaluation functionality could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions. Defenders responsible for PingFederate deployments should assess exposure and verify administrative role access to the affected functionality.

  • Defenders should verify and limit administrative role access to the affected functionality to prevent potential misuse.
  • Reviewing and adjusting role-based access controls can help prevent similar issues in the future.
  • Monitoring for potential misuse can help detect and respond to potential security incidents.

Technical summary

A role-based access control issue was identified in the administrative expression evaluation functionality of PingFederate. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.

Defensive priority

Defenders should prioritize verifying and limiting administrative role access to the affected functionality, reviewing and adjusting role-based access controls, and monitoring for potential misuse.

Recommended defensive actions

  • Verify and limit administrative role access to the affected functionality
  • Review and adjust role-based access controls
  • Monitor for potential misuse

Evidence notes

The CVE record and NVD entry provide details on the role-based access control issue in PingFederate's administrative expression evaluation functionality.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-20773 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-20773

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-20773 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-20773

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://support.pingidentity.com/s/article/SECADV054-Improper-Authorization-in-PingFederate-Administrative-Expression-Evaluation-Endpoint

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.