CVE-2026-20746

{
  "id": "CVE-2026-20746",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T04:17:04.510",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values."
    },
    {
      "lang": "es",
      "value": "El manejo de atributos virtuales en PingDirectory de Ping Identity en versiones afectadas permite solo a usuarios autorizados agotar el heap de memoria de Java cuando el historial de inicio de sesión reciente está habilitado y se copian atributos virtuales que hacen referencia a valores ds-privilege-name."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Ping Identity",
          "product": "PingDirectory",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9.3.0.0",
              "lessThanOrEqual": "9.3.0.8",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "10.1.0.0",
              "lessThanOrEqual": "10.1.0.5",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "10.2.0.0",
              "lessThanOrEqual": "10.2.0.5",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "10.3.0.0",
              "lessThanOrEqual": "10.3.0.3",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "11.0.0.0",
              "lessThan": "11.0.0.1",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:X/RE:M/U:Amber",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "HIGH",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "PRESENT",
          "Automatable": "YES",
          "Recovery": "USER",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "providerUrgency": "AMBER"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-12T13:30:44.116370Z",
          "id": "CVE-2026-20746",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.pingidentity.com/pingdirectory/11.0/release_notes/pd_release_notes.html#pingdirectory-suite-of-products-11-0-0-1-march-2026",
      "source": "[email protected]"
    },
    {
      "url": "https://support.pingidentity.com/s/article/SECADV052-Denial-of-Service-via-copying-virtual-attributes",
      "source": "[email protected]"
    },
    {
      "url": "https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html",
      "source": "[email protected]"
    }
  ]
}