CVE-2022-23726: Pingidentity Pingcentral

Medium severity, CVSS 4.9. EPSS: 0.7% chance of exploitation in the next 30 days.

PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information.

Affected products

• Pingidentity Pingcentral: from 1.8, before 1.8.4 (fixed in 1.8.4); from 1.9, before 1.9.3 (fixed in 1.9.3)

Published 2022-09-30. Last modified 2026-06-17.