Pega Robot Studio CVE-2026-1078

Requires Pega Robotic Automation version 22.1 or R25 with Pega Browser Extension installed in Google Chrome or Microsoft Edge. A Robot Runtime user must navigate to an attacker-controlled malicious website. No authentication required; victim interaction (visiting website) is necessary.

The 7.2 CVSS score reflects genuine risk but requires careful contextualization. The network attack vector (AV:N) and low attack complexity (AC:L) indicate ease of exploitation once conditions are met, but the attack requires present attack timing (AT:P) and user interaction (UI:P), meaning users must actively navigate to malicious sites during automation execution. No EPSS score is available for this 2026 CVE, and no confirmed active exploitation (not in CISA KEV) or public proof-of-concept exists. The real-world risk is moderate: while the technical barrier is low for attackers to create malicious sites, successful exploitation depends on social engineering Robot Runtime users during specific operational windows. Organizations using Pega RPA in production environments face meaningful risk because compromised automation systems could enable persistent access, data exfiltration, or disruption of business processes. The high subsequent system integrity and availability impacts suggest potential for lateral movement or operational disruption beyond initial file write. This warrants priority attention for organizations actively using affected Pega RPA versions, particularly in environments where Robot Runtime users have broad system access.

An attacker creates a convincing phishing site or compromises a legitimate website that Robot Runtime users might visit during their automation workflows. When a user running Pega Robotic Automation navigates to this malicious site using Chrome or Edge with the Pega Browser Extension active, the attacker's embedded JavaScript exploits the improper access control to write arbitrary files to the victim's system. The attacker could plant malicious executables in startup folders, overwrite configuration files to establish persistence, or modify automation scripts to exfiltrate sensitive data processed by future RPA tasks. Given the high subsequent system impact ratings, successful exploitation could enable the attacker to compromise the entire RPA infrastructure and potentially pivot to connected enterprise systems.