CVE-2026-1562

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

View on CVE.org
Published Jul 15, 2026 CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Description
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

Analysis

AI-generated

Technical impact

This vulnerability is a stored cross‑site scripting flaw in a user interface component of Pega Platform. The flaw, identified as CWE‑79, allows a user with high privileged developer role to inject malicious scripts that persist in the system.

Affected Systems

Pegasystems Pega Infinity Platform versions 8.1.0 through 25.1.2.

Risk and Exploitability

The CVSS score of 4.6 classifies the risk as medium, while an EPSS score of <1% indicates a very low current exploitation likelihood. The vulnerability is not in the CISA KEV catalog. Exploitation requires possession of a high‑privileged developer account or compromise of such an account, so the attack vector is limited to users with those permissions. Because the payload runs in the victim’s browser, the threat is primarily directed at users who interact with the affected component, and the overall risk remains moderate.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Pega Platform patch or upgrade to a version that addresses the stored XSS issue as advised in Pega’s security advisory (https://support.pega.com/support-doc/pega-security-advisory-e26-vulnerability-remediation-note).
  • If a patch is unavailable, restrict the developer role to only the minimum necessary permissions and disable public editing of the affected component until remediation is applied.
  • Enable Content Security Policy and ensure all custom UI input is sanitized on the server side to mitigate injection risk if a future exploit emerges.

Generated by OpenCVE AI on July 31, 2026 at 03:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Pegasystems
Pegasystems pega Infinity
Vendors & Products Pegasystems
Pegasystems pega Infinity
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
Title Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 4.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Pega
Published
Updated
Jul 15, 2026, 6:13 PM
Reserved
Jan 28, 2026, 7:59 PM

View source JSON

Updated
Jul 15, 2026, 6:12 PM

JSON

Status
Analyzed
Published
Jul 15, 2026, 5:16 PM
Modified
Oct 24, 2026, 9:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 3:30 AM

JSON