CVE-2026-20746: medium-severity vulnerability in PingDirectory
PingDirectory copying of virtual attributes leads to memory exhaustion
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.3%
Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H/S:P/AU:Y/R:U/RE:M/U:Amber
Affected products
Ping Identity · PingDirectoryRelated CVEs — PingDirectory
In the same product, most dangerous first.
References
https://docs.pingidentity.com/pingdirectory/11.0/release_notes/pd_release_notes.html#pingdirectory-suite-of-products-11-0-0-1-march-2026https://support.pingidentity.com/s/article/SECADV052-Denial-of-Service-via-copying-virtual-attributeshttps://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html