Medium severity · published Aug 10, 2026
CVE-2025-32736
PingFederate Administrative Console CSRF weaknesses
4.9
CVSS
0.2%
EPSS
No
On KEV
Description
Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
PingFederate · Ping Identity
10.0 before 13.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-32736
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-32736
docs.pingidentity.com
https://docs.pingidentity.com/pingfederate/13.1/release_notes/pf_release_notes.html#pingfederate-13-1-june-2026
www.pingidentity.com
https://www.pingidentity.com/en/resources/downloads/pingfederate.html
More from PingFederate
9.8
CVE-2023-40545
PingFederate OAuth client_secret_jwt Authentication Bypass
9.8
CVE-2023-37283
Authentication Bypass via HTML Form & Identifier First Adapter
8.8
CVE-2022-40724
Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.
8.5
CVE-2026-20773
Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint
7.5
CVE-2023-39219
Admin Console Denial of Service via Java class enumeration