Pegasystems Pega Infinity vulnerabilities
30 vulnerabilities
Known vulnerabilities in Pegasystems Pega Infinity, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
PrioritiseCVE-2026-13761pegasystems · pega infinityPega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.CVSS8.8HighEPSS0.43%RoutineCVE-2026-10754pegasystems · pega infinityPega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.CVSS8.6HighEPSS0.78%RoutineCVE-2026-14337pegasystems · pega infinityPega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.CVSS4.6MediumEPSS0.42%RoutineCVE-2026-1563pegasystems · pega infinity +1 morePega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.CVSS4.8MediumEPSS0.24%RoutineCVE-2026-1562pegasystems · pega infinity +1 morePega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.CVSS4.8MediumEPSS0.24%RoutineCVE-2025-62180pegasystems · pega infinityPega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.CVSS7.1HighEPSS0.36%RoutineCVE-2026-1711pegasystems · pega infinity +1 morePega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.CVSS4.8MediumEPSS0.19%RoutineCVE-2026-1564pegasystems · pega infinity +1 morePega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.CVSS5.1MediumEPSS0.19%RoutineCVE-2025-62184pegasystems · pega infinity +1 morePega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.Requires an administrative user and given extensive access rights, impact to Confidentiality is low and Integrity is none.CVSS4.8MediumEPSS0.27%RoutineCVE-2025-62183pegasystems · pega infinityPega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality and Integrity are low.CVSS4.8MediumEPSS0.29%RoutineCVE-2025-62182pegasystems · pega infinityPega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file.CVSS5.3MediumEPSS0.27%RoutineCVE-2025-62181pegasystems · pega infinityPega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.This only applies to deprecated basic-authentication feature and other more secure authentication mechanisms are recommended. A fix is being provided in the 24.1.4, 24.2.4, and 25.1.1 patch releases. Please note: Basic credentials authentication service type is deprecated started in 24.2 version: https://docs.pega.com/bundle/platform/page/platform/release-notes/security/whats-new-security-242.html.CVSS5.3MediumEPSS0.44%RoutineCVE-2025-9559pegasystems · pega infinity +1 morePega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read dataCVSS6.5MediumEPSS0.40%RoutineCVE-2025-8681pegasystems · pega infinity +1 morePega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface componentRequires a high privileged user with a developer role.CVSS5.5MediumEPSS0.19%RoutineCVE-2025-2161pegasystems · pega infinity +2 morepegasystems pega infinityPega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with MashupCVSS7.1HighEPSS0.28%RoutineCVE-2025-2160pegasystems · pega infinity +1 morepegasystems pega infinityPega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with MashupCVSS8.1HighEPSS0.28%RoutineCVE-2024-12211pegasystems · pega infinity +1 morepegasystems pega infinityPega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.CVSS5.4MediumEPSS0.33%RoutineCVE-2024-10716pegasystems · pega infinity +1 morepegasystems pega infinityPega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.CVSS5.9MediumEPSS0.21%PrioritiseCVE-2024-10094pegasystems · pega infinity +1 morepegasystems pega infinityPega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of CodeCVSS9.8CriticalEPSS0.48%RoutineCVE-2024-6702pegasystems · pega infinity +1 morepegasystems pega infinityPega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.CVSS5.2MediumEPSS0.26%