CVE-2025-32736

MediumCVSS 4.9

Published: 10/08/2026(UTC)Updated: 29/09/2026(UTC)Translated: 11/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

PingFederate versions before 13.1 have CSRF weaknesses in the Administrative Console that may allow attackers to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.

Risk Assessment

Risk of unauthorized changes to system configuration, which could lead to security breaches or service disruptions.

Recommendation

Upgrade PingFederate to version 13.1 or later which includes fixes. Additionally, educate administrators about the risk of clicking suspicious links.

Other vulnerabilities in PingFederate

CVE-2025-26862Unknown
Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.

Original NVD description (English source)

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS