How severe is CVE-2021-40329?

CVE-2021-40329 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2021-40329 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-40329?

CVE-2021-40329 affects Pingidentity Pingfederate. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-40329?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2021-40329 published?

CVE-2021-40329 was published on 2021-09-27 and last updated on 2026-06-17.

CVE-2021-40329

CVE-2021-40329 is a critical-severity vulnerability in Pingidentity Pingfederate with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 1% (62nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Pingidentity Pingfederate
Published: 2021-09-27
Last modified: 2026-06-17

Description

The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.

Frequently asked questions

What is CVE-2021-40329?: The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.
How severe is CVE-2021-40329?: CVE-2021-40329 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-40329 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-40329?: CVE-2021-40329 affects Pingidentity Pingfederate. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-40329?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2021-40329 published?: CVE-2021-40329 was published on 2021-09-27 and last updated on 2026-06-17.

References

https://docs.pingidentity.com/bundle/pingfederate-103/page/cou1615333347158.html

Affected products (1)

cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*

More vulnerabilities in Pingidentity Pingfederate

CVE-2023-40545 — High (CVSS 8.8): Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3…
CVE-2023-37283 — High (CVSS 8.1): Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate…
CVE-2022-40722 — High (CVSS 7.7): A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID…
CVE-2023-39219 — High (CVSS 7.5): PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java…
CVE-2021-41770 — High (CVSS 7.5): Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve…
CVE-2022-40723 — Medium (CVSS 6.5): The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to…

All CVEs affecting Pingidentity Pingfederate →