High severity · published Apr 7, 2026
CVE-2026-1078
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge.
7.2
CVSS
0.3%
EPSS
No
On KEV
Description
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. A bad actor could create a website that includes malicious code. The vulnerability could occur if a Robot Runtime user navigates to the malicious website.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Pega Robot Studio · Pegasystems
22.1; R25 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1078
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1078
support.pega.com
https://support.pega.com/support-doc/pega-security-advisory-a26-vulnerability-remediation-note
More from Pega Robot Studio
9.0
CVE-2026-0898
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25.