Pega Platform vulnerabilities
29 vulnerabilities
Known vulnerabilities in Pega Platform, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2026-1563pegasystems · pega infinity +1 morePega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.CVSS4.8MediumEPSS0.24%RoutineCVE-2026-1562pegasystems · pega infinity +1 morePega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.CVSS4.8MediumEPSS0.24%RoutineCVE-2026-1711pegasystems · pega infinity +1 morePega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.CVSS4.8MediumEPSS0.19%RoutineCVE-2026-1564pegasystems · pega infinity +1 morePega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.CVSS5.1MediumEPSS0.19%RoutineCVE-2025-62184pegasystems · pega infinity +1 morePega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.Requires an administrative user and given extensive access rights, impact to Confidentiality is low and Integrity is none.CVSS4.8MediumEPSS0.27%RoutineCVE-2025-9559pegasystems · pega infinity +1 morePega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read dataCVSS6.5MediumEPSS0.40%RoutineCVE-2025-8681pegasystems · pega infinity +1 morePega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface componentRequires a high privileged user with a developer role.CVSS5.5MediumEPSS0.19%RoutineCVE-2025-2161pegasystems · pega infinity +2 morepegasystems pega infinityPega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with MashupCVSS7.1HighEPSS0.28%RoutineCVE-2025-2160pegasystems · pega infinity +1 morepegasystems pega infinityPega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with MashupCVSS8.1HighEPSS0.28%RoutineCVE-2024-12211pegasystems · pega infinity +1 morepegasystems pega infinityPega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.CVSS5.4MediumEPSS0.33%RoutineCVE-2023-50168pegasystems · pega platform +1 morepegasystems pega platformPega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.CVSS7.7HighEPSS0.39%RoutineCVE-2023-50167pegasystems · pega platform +1 morepegasystems pega platformPega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content.CVSS6.1MediumEPSS0.30%RoutineCVE-2023-4843pegasystems · pega platform +1 morepegasystems pega platformPega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an authenticated administrative user.CVSS4.8MediumEPSS0.34%PrioritiseCVE-2023-32090pegasystems · pega platform +1 morepegasystems pega platformPega platform clients who are using versions 6.1 through 7.3.1 may be
utilizing default credentialsCVSS9.8CriticalEPSS0.62%PrioritiseCVE-2023-28094pegasystems · pega platform +1 morepegasystems pega platformPega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials.CVSS9.8CriticalEPSS0.53%RoutineCVE-2023-26465pegasystems · pega infinity +1 morepegasystems pega infinityPega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.CVSS8.0HighEPSS0.44%RoutineCVE-2022-35656pegasystems · pega infinity +1 morepegasystems pega infinityPega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.CVSS6.8MediumEPSS0.33%RoutineCVE-2022-35655pegasystems · pega infinity +1 morepegasystems pega infinityPega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.CVSS6.1MediumEPSS0.48%RoutineCVE-2022-35654pegasystems · pega infinity +1 morepegasystems pega infinityPega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.CVSS6.1MediumEPSS0.53%PrioritiseCVE-2020-15390pega · pega_platformpega pega_platformpyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo.CVSS9.8CriticalEPSS1.40%