VMware Pinniped vulnerabilities

3 CVEs affecting VMware Pinniped, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59269, published 2026-07-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22975, published 2022-05-11. Medium severity, CVSS 6.6. EPSS: 1% chance of exploitation in the next 30 days. An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name…
CVE-2022-31677, published 2022-08-29. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use…
CVE-2026-59269, published 2026-07-09. Low severity, CVSS 3.8. EPSS: 0.3% chance of exploitation in the next 30 days. A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped…