Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Vendors
Pega

Pega Vulnerabilities: CVEs, CISA KEV & Security Advisories

60 CVEs

PE

Pega Vulnerabilities

CVE security advisories and vulnerability history for Pega.

60

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

9

Public exploits

PoC or exploit code

6.8

Avg CVSS

2017–2026

Overview

Pega has 60 published CVE records since 2017, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 9 have a known public exploit. The average CVSS base score across scored CVEs is 6.8.

Security scorecard

A quick read on Pega's vulnerability posture, as a share of its 60 published CVEs.

Average CVSS: 6.8
Critical / high: 38%
Actively exploited (KEV): 0%
Public exploit available: 15%
Patch available: 77%

Severity and exploitation

How the CVSS severity of Pega's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical9

High14

Medium37

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Pega's CVEs are currently listed in CISA's KEV catalog.

Public exploits

9

9 of Pega's CVEs have a known public exploit available.

Most affected products

The Pega products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Pega Platform34 CVEs
Pega Infinity31 CVEs
infinity10 CVEs
platform8 CVEs
synchronization engine3 CVEs
RPA: Synchronization Engine3 CVEs
Pega Robot Studio2 CVEs
Pega Browser Extension (PBE)1 CVE

Common weakness types

The CWE weakness categories most often found in Pega CVEs. Follow any weakness for its full explanation.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')28 CVEs
CWE-284Improper Access Control4 CVEs
CWE-285Improper Authorization2 CVEs
CWE-425Direct Request ('Forced Browsing')2 CVEs
CWE-639Authorization Bypass Through User-Controlled Key2 CVEs
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')2 CVEs
CWE-1393Use of Default Password2 CVEs
CWE-287Improper Authentication1 CVE

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Pega CVE records.

Pega47 CVEs
mitre13 CVEs

Disclosure activity by year

How many Pega CVEs were published each year.

2019

3

2020

6

2021

3

2022

6

2023

10

2024

9

2025

6

2026

14

Latest Pega CVEs

The most recently disclosed vulnerabilities affecting Pega.

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
CWE-606
High · CVSS 8.8
EPSS 0.3%2026-08-28
Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.
CWE-347
High · CVSS 8.6
EPSS 0.8%2026-08-10
Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
CWE-79
Medium · CVSS 4.6
EPSS 0.4%2026-08-04
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
CWE-79
Medium · CVSS 4.8
EPSS 0.2%2026-07-15
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
CWE-79
Medium · CVSS 4.6
EPSS 0.2%2026-07-15
Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.
CWE-639
High · CVSS 7.1
EPSS 0.4%2026-06-23
Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.
CWE-79
Medium · CVSS 4.8
EPSS 0.2%2026-04-15
Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.
CWE-80
Medium · CVSS 5.1
EPSS 0.2%2026-04-15
A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension.
CWE-284
Medium · CVSS 6.0
EPSS 0.3%2026-04-07
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge.
CWE-284
High · CVSS 7.2
EPSS 0.3%2026-04-07
Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.
CWE-79
Medium · CVSS 4.8
EPSS 0.3%2026-03-31
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25.
CWE-284
Critical · CVSS 9.0
EPSS 0.3%2026-03-23

Get an alert for each new Pega CVE, with AI-written analysis and remediation steps.

Monitor Pega CVEs

Other vendors

CVE counts for other vendors.

microsoft42,015 CVEs linux25,264 CVEs Google17,495 CVEs Apple15,508 CVEs Oracle13,348 CVEs Debian10,234 CVEs IBM9,452 CVEs Red Hat8,588 CVEs

Browse all vendors

Frequently asked questions

Common questions about Pega vulnerabilities.

How many CVEs does Pega have?: Pega has 60 published CVE records since 2017, including 20 in the last two years.
How many Pega CVEs are in CISA KEV?: None of Pega's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which Pega products have the most CVEs?: The Pega products with the most published CVEs are Pega Platform, Pega Infinity, infinity, platform, synchronization engine.
What are the most common weakness types in Pega CVEs?: Pega's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-284 (Improper Access Control), CWE-285 (Improper Authorization), CWE-425 (Direct Request ('Forced Browsing')).
Are there public exploits for Pega vulnerabilities?: Yes — 9 of Pega's CVEs have a known public exploit.
How many critical Pega vulnerabilities are there?: Pega has 9 critical and 14 high-severity CVEs.
What is the average severity of Pega CVEs?: The average CVSS base score across Pega's scored CVEs is 6.8.

References

The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to
CNA directory: the CNAs that assign these CVEs

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Pega vulnerabilities

Get an alert for each new Pega CVE, with AI-written analysis and remediation steps.

Create an account See pricing

On this page

Overview
Security scorecard
Severity and exploitation
Most affected products
Common weakness types
Assigning CNAs
Disclosure activity
Latest CVEs
Other vendors
FAQ
References