Denial of Service in Ping Identity PingDirectory Due to Virtual Attribute Mismanagement
CVE-2026-20746

6.3MEDIUM

Key Information:

Vendor

Ping Identity

Status
Pingdirectory
Vendor
CVE Published:
12 June 2026

What is CVE-2026-20746?

A vulnerability in Ping Identity's PingDirectory allows authorized users to cause a denial of service by exhausting the Java memory heap. This issue occurs when recent login history is enabled and users attempt to copy virtual attributes that reference ds-privilege-name values. Exploiting this vulnerability can lead to service interruptions, impacting the overall system performance and availability.

Affected Version(s)

PingDirectory 9.3.0.0 <= 9.3.0.8

PingDirectory 10.2.0.0 <= 10.2.0.5

PingDirectory 10.3.0.0 <= 10.3.0.3

References

https://docs.pingidentity.com/pingdirectory/11.0/release_...
https://www.pingidentity.com/en/resources/downloads/pingd...
https://support.pingidentity.com/s/article/SECADV052-Deni...

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.