Skip to contentPegasystems Pega Infinity vulnerabilities
- pegasystems pega infinityPega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because…CVE-2026-137618.8 High
- pegasystems pega infinityPega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.CVE-2026-107548.6 High
- pegasystems pega infinityPega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.CVE-2026-143374.6 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.CVE-2026-15634.8 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.CVE-2026-15624.6 Medium
- pegasystems pega infinityPega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.CVE-2025-621807.1 High
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.CVE-2026-17114.8 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.CVE-2026-15645.1 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.CVE-2025-621844.8 Medium
- pegasystems pega infinityPega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights…CVE-2025-621834.8 Medium
- pegasystems pega infinityPega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file.CVE-2025-621825.3 Medium
- pegasystems pega infinityPega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated use…CVE-2025-621815.3 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read dataCVE-2025-95596.5 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface componentCVE-2025-86815.5 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with MashupCVE-2025-21608.1 High
- pega platform, pegasystems pega infinity +1 morePega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with MashupCVE-2025-2161Fix available7.1 High
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.CVE-2024-122115.4 Medium
- pega infinity, pegasystems pega infinity +1 morePega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.CVE-2024-107165.9 Medium
- pega infinity, pegasystems pega infinity +1 morePega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of...CVE-2024-100949.1 Critical
- pega infinity, pegasystems pega infinity +1 morePega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.CVE-2024-67025.2 Medium
- pega infinity, pegasystems pega infinity +1 morePega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.CVE-2024-67015.5 Medium
- pega infinity, pegasystems pega infinity +1 morePega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.CVE-2024-67005.5 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.CVE-2023-264658.0 High
- pega platform, pegasystems pega infinity +1 morePega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to...CVE-2022-356566.8 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a...CVE-2022-356556.1 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and...CVE-2022-356546.1 Medium
- pega infinity, pegasystems pega infinity +1 morePassword authentication bypass vulnerability for local accounts can be used to bypass local...CVE-2022-240839.8 Critical
- pega infinity, pegasystems pega infinity +1 moreIf an on-premise installation of the Pega Platform is configured with the port for the JMX...CVE-2022-24082Public exploitEPSS 12.2%9.8 Critical
- pega infinity, pegasystems pega infinity +1 moreForgotten password reset functionality for local accounts can be used to bypass local...CVE-2021-276548.8 High
- pega infinity, pegasystems pega infinity +1 moreIn versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local...CVE-2021-27651Public exploitEPSS 53.8%9.8 Critical
- pega infinity, pegasystems pega infinity +1 moreMisconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead...CVE-2021-276536.6 Medium