Critical severity · published Mar 23, 2026
CVE-2026-0898
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25.
9.0
CVSS
0.3%
EPSS
No
On KEV
Description
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. This vulnerability does not affect Robot Runtime users. A bad actor could create a website that includes malicious code. The vulnerability may be exploited if a Pega Robot Studio developer is deceived into visiting this website during interrogation mode in Robot Studio.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Pega Robot Studio · Pegasystems
22.1; R25 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0898
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0898
support.pega.com
https://support.pega.com/support-doc/pega-security-advisory-p25-vulnerability-remediation-note
More from Pega Robot Studio
7.2
CVE-2026-1078
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge.