Is CVE-2026-20746 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20746 being exploited in the wild.

How severe is CVE-2026-20746?

Informational severity, with a CVSS score of 6.3, published 12 June 2026.

Which products and versions are affected?

Ping Identity PingDirectory Versions prior to 11.0.0.1.

Is there a fix for CVE-2026-20746?

A patch was published on 2026-03-01: Fixed in version 11.0.0.1 release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20746 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-20746?

Check whether you run Ping Identity PingDirectory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20746: Ping Identity PingDirectory memory exhaustion in virtual attribute handling

CVE-2026-20746 · Severity: info · CVSS 6.3 · Published 2026-06-12

Ping Identity PingDirectory is a high-performance directory server used to store and manage identity data. A vulnerability in how the server handles specific internal attributes allows an authorized user to trigger a memory exhaustion condition, potentially leading to a denial-of-service (DoS) state. This occurs when the server is configured to track recent login history and certain virtual attributes are copied.

Vendors: Ping Identity.

Quick answers

Is CVE-2026-20746 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20746 being exploited in the wild.
How severe is CVE-2026-20746?: Informational severity, with a CVSS score of 6.3, published 12 June 2026.
Which products and versions are affected?: Ping Identity PingDirectory Versions prior to 11.0.0.1.
Is there a fix for CVE-2026-20746?: A patch was published on 2026-03-01: Fixed in version 11.0.0.1 release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20746 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20746?: Check whether you run Ping Identity PingDirectory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory leak vulnerability (CWE-401) exists in Ping Identity PingDirectory's virtual attribute handling mechanism. The issue is triggered when the 'recent login history' feature is enabled and an authorized user performs operations involving the copying of virtual attributes that reference 'ds-privilege-name' values. This can lead to Java heap exhaustion, resulting in a Denial of Service (DoS). The attack requires high privileges (PR:H) and some user interaction (UI:P) according to the vendor's CVSS vector. The issue is addressed in PingDirectory version 11.0.0.1 and later.

Affected products

Ping Identity PingDirectory Versions prior to 11.0.0.1

Timeline

2026-03-01: patched: Fixed in version 11.0.0.1 release
2026-06-12: disclosed: Initial advisory publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.