PingGateway CVE-2026-80327

Exploitation requires the PingGateway Fragment Filter feature to be in use, as the open redirect resides specifically in that filter's handling of URLs. The CVSS vector's UI:A metric means a victim must actively interact - typically by clicking an attacker-crafted link to the PingGateway endpoint - so the flaw cannot be triggered without social engineering. No authentication is required (PR:N), making any user with a reachable PingGateway instance a potential delivery target. Limiting factors: the mandatory user interaction, the requirement that the Fragment Filter feature be deployed, and the affected version ranges (7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1) - instances on fixed builds 2024.11.2, 2025.11.2, or 2026.3.0+ are not affected.

This is a medium-severity open redirect (CWE-601) with a vendor-assigned CVSS 4.0 base score of 5.1. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) indicates network-reachable, low-complexity exploitation requiring no privileges but requiring active user interaction (UI:A) - i.e., a victim must click or follow a crafted link. Impacts are limited to low confidentiality and low integrity on both the vulnerable and a subsequent system (SC:L/SI:L), consistent with the phishing/credential-relay nature of redirect flaws rather than direct system compromise. No EPSS score, CISA KEV listing, or POC indicator is present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' There is no signal conflict: the low CVSS, dependence on user interaction, and lack of code-execution impact all align toward a genuinely lower-tier issue. This is not an emergency patch-tonight item; it is a real but lower-priority finding best remediated in a normal patch cycle, with elevated attention for internet-facing PingGateway deployments used in authentication flows where a redirect can be chained into phishing or OAuth/OIDC token theft.

An attacker crafts a malicious URL pointing at a victim organization's PingGateway Fragment Filter endpoint that, once clicked, transparently redirects the user to an attacker-controlled site. Because the link originates from the trusted PingGateway domain, it is used in phishing to harvest credentials or to abuse OAuth/OIDC redirect handling for token interception. No public exploit code is identified at time of analysis, and the attack succeeds only if the targeted user actively follows the crafted link (UI:A).