CVE-2026-20773

8.5 highEPSS 0.4%

High (8.5). EPSS 0.4% chance of exploitation in the next 30 days.

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.

Severity

CVSS 4.0

8.5 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2026-09-14
Modified: 2026-09-18
Record from: the NVD, synced 2026-10-19

References

https://support.pingidentity.com/s/article/SECADV054-Improper-Authorization-in-PingFederate-Administrative-Expression-Evaluation-Endpoint

Check your stack JSON