Pegasystems vulnerabilities
We track 6 vulnerabilities in Pegasystems products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on August 28, 2026.
Latest Pegasystems vulnerabilities
- 8.8 High severity
Pega Infinity: Unchecked Input for Loop Condition
Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
- 8.6 High severity
Pega Infinity: Improper Verification of Cryptographic Signature
Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.
- 7.1 High severity
Pega Infinity: Authorization Bypass Through User-Controlled Key
Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.
- 7.2 High severity
Pega Robot Studio: Improper Access Control
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. A bad actor could create a website that includes malicio
- 9.0 Critical severity
Pega Robot Studio: Improper Access Control
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. This vulnerability does not affect Robot Runtime users. A bad actor
- 9.8 Critical severity
Pega Infinity: Deserialization of Untrusted Data
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. T