Pegasystems vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-13761	PI Pega Infinity Pegasystems	8.8	0%	Aug 28	Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
CVE-2026-10754	PI Pega Infinity Pegasystems	8.6	1%	Aug 10	Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.
CVE-2026-14337	PI Pega Infinity Pegasystems	4.6	0%	Aug 4	Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
CVE-2026-1563	PI Pega Infinity Pegasystems	4.8	0%	Jul 15	Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
CVE-2026-1562	PI Pega Infinity Pegasystems	4.8	0%	Jul 15	Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
CVE-2025-62180	PI Pega Infinity Pegasystems	7.1	0%	Jun 23	Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.
CVE-2026-1711	PI Pega Infinity Pegasystems	4.8	0%	Apr 15	Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.
CVE-2026-1564	PI Pega Infinity Pegasystems	4.8	0%	Apr 15	Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.
CVE-2026-1079	PB Pega Browser Extension (PBE) Pegasystems	6.0	0%	Apr 7	A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension.
CVE-2026-1078	PR Pega Robot Studio Pegasystems	7.2	0%	Apr 7	An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge.
CVE-2025-62184	PI Pega Infinity Pegasystems	3.4	0%	Mar 31	Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.
CVE-2026-0898	PR Pega Robot Studio Pegasystems	9.0	0%	Mar 23	An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25.
CVE-2025-62183	PI Pega Infinity Pegasystems	4.8	0%	Feb 17	Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality and Integrity are low.
CVE-2025-62182	PI Pega Infinity Pegasystems	5.3	0%	Jan 13	Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file.
CVE-2025-62181	PI Pega Infinity Pegasystems	5.3	0%	Dec 10	Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.