What is the CVSS score of CVE-2025-62181?

CVE-2025-62181 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Pega Platform CVE-2025-62181

MEDIUM

Observable Response Discrepancy (CWE-204)

2025-12-10 security@pega.com

Information Disclosure

5.3

CVSS 3.1 · Vendor: pega

Severity by source

Vendor (pega) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.7 LOW

Remote unauthenticated (AV:N/PR:N) but AC:H because a network timing side-channel is noisy and requires the non-default deprecated basic-auth feature; only username validity leaks, so C:L, I:N, A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (pega).

CVSS VectorVendor: pega

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 26, 2026 - 00:03 vuln.today

DescriptionCVE.org

Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not. This only applies to deprecated basic-authentication feature and other more secure authentication mechanisms are recommended. A fix is being provided in the 24.1.4, 24.2.4, and 25.1.1 patch releases. Please note: Basic credentials authentication service type is deprecated started in 24.2 version: https://docs.pega.com/bundle/platform/page/platform/release-notes/security/whats-new-security-242.html.

AnalysisAI

User enumeration in Pega Platform can reveal whether a supplied username is valid when the deprecated basic-credentials authentication service type is enabled, affecting versions 7.1.0 through Infinity 25.1.0. The issue depends on measurable response-time differences during authentication, and the independent assessment rates it low priority because it requires the deprecated service and reliable timing discrimination; no credentials, data, or system control are obtained. Patches are available in 24.1.4, 24.2.4, and 25.1.1; EPSS is 0.44% (36th percentile) and no public exploit identified at time of analysis.

Technical ContextAI

CWE-204 (Observable Response Discrepancy) is the root-cause class: the authentication process returns differing response times for valid versus invalid usernames, creating a side channel that can be measured remotely. Pega Platform is a low-code application platform whose authentication service types include basic credentials, deprecated as of 24.2; the vulnerable behavior is only present when that deprecated basic-authentication service is enabled. The request is network-accessible with no privileges or user interaction (AV:N/PR:N/UI:N), but the independent assessment sets AC:H because reliable timing discrimination across network jitter is nontrivial and the deprecated service must be in use; impact is limited to username-validity disclosure (C:L), with no integrity or availability effect. No CPE strings were included in the provided data, but affected versions span 7.1.0 through Infinity 25.1.0.

Affected ProductsAI

Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected, but only when the deprecated basic-credentials authentication service type is enabled; deployments using more secure authentication mechanisms are not exploitable. The vendor fixed this in patch releases 24.1.4, 24.2.4, and 25.1.1. The vendor advisory is available at https://support.pega.com/support-doc/pega-security-advisory-j25-vulnerability-remediation-note. No CPE strings were supplied in the input data.

RemediationAI

Vendor-released patch: 24.1.4, 24.2.4, and 25.1.1. Upgrade to the applicable fixed release according to the Pega Platform release train. If upgrading cannot be done immediately, disable the deprecated basic-credentials authentication service type and migrate to a more secure authentication mechanism, because only that service is affected and deployments already off basic auth are not exposed. As a further compensating measure, restrict network access to any endpoint that uses basic authentication or place it behind trusted networks, with the trade-off that legacy integrations or scripts relying on basic auth may break. Timing-based mitigations such as adding network jitter are unreliable and not a substitute for patching. Vendor advisory: https://support.pega.com/support-doc/pega-security-advisory-j25-vulnerability-remediation-note.