PingFederate and PingAccess
CVE-2022-40723: Configuration-based MFA Bypass in PingID RADIUS PCV.
The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityMEDIUMCVSS 3.1 6.5
EPSS0.52%Chance of exploitation in 30 days
Public exploitNot tracked
FixAvailable
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| PingID Radius PCV 2.10 | See the advisory |
| PingID Radius PCV 3.0 | 3.0.0* or later |
| PingID Radius PCV 3.0.2 to 3.0.2 | Upgrade past 3.0.2; see the advisory |
| PingID Integration Kit (includes Radius PCV) 2.24 | 2.24 or later |
| PingFederate (includes Radius PCV) 11.1 | 11.1.0* or later |
| PingFederate (includes Radius PCV) 11.1.5 to 11.1.5 | Upgrade past 11.1.5; see the advisory |
| PingFederate (includes Radius PCV) 11.2 | 11.2.0* or later |
| PingFederate (includes Radius PCV) 11.2.2 to 11.2.2 | Upgrade past 11.2.2; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.