Vendor
Ping Identity
52 known vulnerabilities in products by Ping Identity, 0 of them actively exploited (CISA KEV).
Key figures
52
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
7
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2022-23718 | Ping Identity PingID Windows Login: OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components | 7.6 | |
| Critical | CVE-2026-21391 | Improper Claim Validation in PingAM OIDC Provider | — | |
| Critical | CVE-2021-40329 | Ping Identity PingFederate: security vulnerability | 9.8 | |
| Critical | CVE-2025-20059 | PingAM Java Policy Agent path traversal | 9.1 | |
| Critical | CVE-2023-40545 | PingFederate OAuth client_secret_jwt Authentication Bypass | 8.8 | |
| High | CVE-2026-20773 | Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint | — | |
| Critical | CVE-2023-37283 | Authentication Bypass via HTML Form & Identifier First Adapter | 8.1 | |
| High | CVE-2025-27935 | Authentication Bypass in OTP (One-time Passcode) IdP Adapter Integration Kit | — | |
| Critical | CVE-2023-39930 | PingFederate PingID Radius PCV Authentication Bypass | 7.5 | |
| High | CVE-2022-23723 | PingFederate PingOneMFA Integration Kit MFA Bypass | 7.7 | |
| High | CVE-2024-23316 | PingAccess HTTP Request Desynchronization Weakness | — | |
| High | CVE-2021-41995 | PingID Mac Login prior to 1.1 vulnerable to pre-computed dictionary attacks | 7.7 | |
| High | CVE-2023-39219 | Admin Console Denial of Service via Java class enumeration | 7.5 | |
| Medium | CVE-2026-80327 | Open Redirect in PingGateway Fragment Filter | — | |
| High | CVE-2023-39231 | PingFederate PingOne MFA IK Device Pairing Second Factor Authentication Bypass | 7.3 | |
| High | CVE-2023-40356 | PingOne MFA Integration Kit MFA bypass | — | |
| High | CVE-2023-36496 | Delegated Admin Virtual Attribute Provider Privilege Escalation | 7.7 | |
| Critical | CVE-2021-42001 | PingID Desktop encryption libraries misconfiguration can lead to sensitive data exposure | 8.0 | |
| High | CVE-2021-41992 | PingID Windows Login RSA cryptographic weakness with possible offline MFA bypass | 7.7 | |
| High | CVE-2023-40702 | PingOne MFA Integration Kit MFA bypass | — | |
| Medium | CVE-2026-20746 | PingDirectory copying of virtual attributes leads to memory exhaustion | — | |
| Medium | CVE-2022-23722 | PingFederate Password Reset via Authentication API Mishandling | 6.5 | |
| Medium | CVE-2025-20628 | Insufficient granularity of access control for Remote Connector Servers in client mode | — | |
| Medium | CVE-2024-25573 | Stored Cross-Site Scripting in Administrative Console Context | — | |
| Medium | CVE-2022-23726 | Ping Identity PingCentral: Exposure of Sensitive Information to an Unauthorized Actor | 5.4 |
Products
| Pingfederate | 18 | 0 |
| Pingid Windows Login | 6 | 0 |
| Pingaccess | 3 | 0 |