Pega Platform CVE-2026-10754

Exploitation requires the attacker to hold at minimum a low-privilege account or valid session on the Pega Infinity platform (PR:L per CVSS 4.0 vector), meaning fully anonymous exploitation is not supported by the available data. The platform must be reachable over a network (AV:N), and no special non-default configuration or specific platform feature activation is described as a prerequisite. What limits exploitation: the low-privilege authentication requirement means an attacker must first obtain some form of platform credentials or session token; organizations that tightly control who can authenticate to Pega reduce their exposed surface. No user interaction is required beyond initial authentication, and attack complexity is low, meaning no race condition or environmental dependency exists once credentials are obtained.

The combination of a network-accessible attack vector, low complexity, and high confidentiality plus integrity impact on the vulnerable system places this vulnerability firmly in the urgent remediation tier for Pega Infinity operators. The vendor-assigned CVSS 4.0 score of 8.6 is consistent with the scope of impact: VC:H/VI:H indicate an attacker who successfully forges a JWT can read sensitive business data and manipulate application state or workflows within the platform. The absence of a CISA KEV listing and no identified public exploit code are moderating factors, but AC:L and AT:N mean that once an exploit is developed, it requires no special conditions to trigger - even a mid-sized municipal IT team in sanok running Pega for citizen-facing services should treat this as urgent given that Pega Infinity is often deployed with access to sensitive case management and business process data. EPSS data was not supplied in the source intelligence, so exploitation probability cannot be quantified. The PR:L prerequisite (low privilege required) is the primary limiting factor; fully unauthenticated exploitation is not supported by the available vector data.

An attacker with a low-privilege account on a Pega Infinity deployment crafts a forged JWT token - for example, by exploiting algorithm confusion or signature omission - and submits it to the platform API. The platform accepts the malformed token as valid, granting the attacker elevated session context, access to restricted case data, or the ability to execute business process actions under another user's identity. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity suggests exploit development is straightforward for a skilled attacker familiar with JWT vulnerabilities.