CVE-2023-36496: Pingidentity Pingdirectory

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.

Affected products

• Pingidentity Pingdirectory: from 8.3.0.0, up to and including 8.3.0.8; from 9.0.0.0, up to and including 9.0.0.5; from 9.1.0.0, up to and including 9.1.0.2; version 9.2.0.0 only; version 9.2.0.1 only; version 9.3.0.0 only; …

Published 2024-02-01. Last modified 2026-06-17.