Pegasystems vulnerabilities

Products

• Pega Infinity 31
• Pega Platform 10
• Rpa: Synchronization Engine 3
• Pega Robot Studio 2

Newest

• pegasystems pega infinity Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because… CVE-2026-13761 8.8 HighAugust 28, 2026
• pegasystems pega infinity Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls. CVE-2026-10754 8.6 HighAugust 10, 2026
• pegasystems pega infinity Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. CVE-2026-14337 4.6 MediumAugust 4, 2026
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. CVE-2026-1563 4.8 MediumJuly 15, 2026
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. CVE-2026-1562 4.6 MediumJuly 15, 2026
• pegasystems pega infinity Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs. CVE-2025-62180 7.1 HighJune 23, 2026
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role. CVE-2026-1711 4.8 MediumApril 15, 2026
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role. CVE-2026-1564 5.1 MediumApril 15, 2026
• pegasystems pega browser extension (pbe) A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension. CVE-2026-1079 6.0 MediumApril 7, 2026
• pegasystems pega robot studio An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Ed… CVE-2026-1078 7.2 HighApril 7, 2026
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. CVE-2025-62184 4.8 MediumMarch 31, 2026
• pegasystems pega robot studio An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. CVE-2026-0898 9.0 CriticalMarch 23, 2026
• pegasystems pega infinity Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights… CVE-2025-62183 4.8 MediumFebruary 17, 2026
• pegasystems pega infinity Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file. CVE-2025-62182 5.3 MediumJanuary 13, 2026
• pegasystems pega infinity Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated use… CVE-2025-62181 5.3 MediumDecember 10, 2025
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data CVE-2025-9559 6.5 MediumOctober 16, 2025
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component CVE-2025-8681 5.5 MediumSeptember 10, 2025
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup CVE-2025-2160 8.1 HighApril 14, 2025
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup CVE-2025-2161 Fix available 7.1 HighFebruary 3, 2025
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile. CVE-2024-12211 5.4 MediumJanuary 13, 2025
• pega infinity, pegasystems pega infinity +1 more Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search. CVE-2024-10716 5.9 MediumDecember 5, 2024
• pega infinity, pegasystems pega infinity +1 more Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of... CVE-2024-10094 9.1 CriticalNovember 20, 2024
• pega infinity, pegasystems pega infinity +1 more Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage. CVE-2024-6702 5.2 MediumSeptember 12, 2024
• pega infinity, pegasystems pega infinity +1 more Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type. CVE-2024-6701 5.5 MediumSeptember 12, 2024
• pega infinity, pegasystems pega infinity +1 more Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name. CVE-2024-6700 5.5 MediumSeptember 12, 2024
• pega platform, pegasystems pega platform +1 more Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation. CVE-2023-50168 7.7 HighMarch 14, 2024
• pega platform, pegasystems pega platform +1 more Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html... CVE-2023-50167 5.4 MediumMarch 6, 2024
• pega platform, pegasystems pega platform +1 more Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and... CVE-2023-50166 6.1 MediumJanuary 31, 2024
• pega platform, pegasystems pega platform +1 more Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could... CVE-2023-50165 8.5 HighJanuary 31, 2024
• pega platform, pegasystems pega platform +1 more Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description CVE-2023-32089 4.6 MediumOctober 18, 2023
• pega platform, pegasystems pega platform +1 more Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case... CVE-2023-32088 4.6 MediumOctober 18, 2023
• pega platform, pegasystems pega platform +1 more Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation CVE-2023-32087 4.6 MediumOctober 18, 2023
• pega platform, pegasystems pega platform +1 more Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field... CVE-2023-4843 4.3 MediumSeptember 8, 2023
• pega platform, pegasystems pega platform +1 more Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default... CVE-2023-32090 9.8 CriticalAugust 7, 2023
• pega platform, pegasystems pega platform +1 more Pega platform clients who are using versions 6.1 through 8.8.3 and have upgraded from a version... CVE-2023-28094 8.1 HighJune 22, 2023
• pega platform, pegasystems pega infinity +1 more Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue. CVE-2023-26465 8.0 HighJune 9, 2023
• pega synchronization engine, pegasystems rpa: synchronization engine +1 more A user with a compromised configuration can start an unsigned binary as a service. CVE-2023-28093 7.5 HighApril 10, 2023
• pega synchronization engine, pegasystems rpa: synchronization engine +1 more A man in the middle can redirect traffic to a malicious server in a compromised configuration. CVE-2023-26467 8.1 HighApril 10, 2023
• pega synchronization engine, pegasystems rpa: synchronization engine +1 more A user with non-Admin access can change a configuration file on the client to modify the Server URL. CVE-2023-26466 7.8 HighApril 10, 2023
• pega platform, pegasystems pega infinity +1 more Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to... CVE-2022-35656 6.8 MediumAugust 22, 2022
• pega platform, pegasystems pega infinity +1 more Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a... CVE-2022-35655 6.1 MediumAugust 22, 2022
• pega platform, pegasystems pega infinity +1 more Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and... CVE-2022-35654 6.1 MediumAugust 22, 2022
• pega infinity, pegasystems pega infinity +1 more Password authentication bypass vulnerability for local accounts can be used to bypass local... CVE-2022-24083 9.8 CriticalJuly 25, 2022
• pega infinity, pegasystems pega infinity +1 more If an on-premise installation of the Pega Platform is configured with the port for the JMX... CVE-2022-24082 Public exploit EPSS 12.2% 9.8 CriticalJuly 19, 2022
• pega infinity, pegasystems pega infinity +1 more Forgotten password reset functionality for local accounts can be used to bypass local... CVE-2021-27654 8.8 HighJanuary 28, 2022
• pega infinity, pegasystems pega infinity +1 more In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local... CVE-2021-27651 Public exploit EPSS 53.8% 9.8 CriticalApril 29, 2021
• pega infinity, pegasystems pega infinity +1 more Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead... CVE-2021-27653 6.6 MediumApril 1, 2021