Skip to main content

Pega Platform CVE-2026-13761

| EUVDEUVD-2026-67718 HIGH
Unchecked Input for Loop Condition (CWE-606)
2026-08-28 Pega GHSA-jrj4-4j46-4jjj
Denial Of Service Pega Infinity
8.8
CVSS 4.0 · Vendor: Pega
Share

Severity by source

Vendor (Pega) PRIMARY
8.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Network-reachable with no authentication required; availability is the primary impact of loop exhaustion; integrity lowered to L as VI:H is vendor-assigned but not clearly substantiated by the description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:L

Primary rating from Vendor (Pega).

CVSS VectorVendor: Pega

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 28, 2026 - 15:46 vuln.today
CVE Published
Aug 28, 2026 - 13:11 cve.org
HIGH 8.8

DescriptionCVE.org

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

AnalysisAI

Pega Platform (marketed as Pega Infinity) versions 7.1.0 through 25.1.2 expose a network-accessible, unauthenticated attack surface via CWE-606 (Unchecked Input for Loop Condition), where attacker-controlled input can trigger unbounded loop execution. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no privileges or user interaction, with vendor-assigned impacts of high integrity and high availability loss on the vulnerable system plus residual availability impact on downstream systems. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The CVSS 4.0 vector (PR:N, UI:N, AV:N, AC:L) confirms exploitation requires no authentication, no user interaction, and no elevated complexity - any network-reachable Pega Platform endpoint that processes the vulnerable loop-conditioned input is exploitable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.8 with AV:N/AC:L/AT:N/PR:N/UI:N represents a high-severity, frictionless attack: no account, no proximity requirement, and no victim interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary remediation is to upgrade Pega Platform beyond version 25.1.2 per the vendor security advisory at https://support.pega.com/support-doc/pega-security-advisory-n26-vulnerability-remediation-note. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Pega Platform deployments currently operating on versions 7.1.0 through 25.1.2 and immediately restrict network access to vulnerable instances to trusted internal networks or behind authentication gateways. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Pega Infinity

View all
CVE-2026-10754 HIGH
8.6 Aug 10

Cryptographic signature validation failure in Pega Platform (Pega Infinity) versions 8.5.0 through 25.1.2 enables low-pr
CVE-2025-62180 HIGH
7.1 Jun 23

Authorization bypass in Pega Platform versions 8.3.0 through Infinity 25.1.2 allows authenticated users to access additi
CVE-2026-1564 MEDIUM
5.1 Apr 15

HTML injection in Pega Platform 8.1.0 through 25.1.1 allows an authenticated high-privileged user with developer role to
CVE-2026-1563 MEDIUM
4.8 Jul 15

Reflected cross-site scripting in Pega Platform (Pega Infinity) versions 8.1.0 through 25.1.2 allows a high-privileged a
CVE-2026-1711 MEDIUM
4.8 Apr 15

Stored cross-site scripting in Pega Infinity allows high-privileged users with developer roles to inject scripts in the

CVE-2025-62184 MEDIUM
4.8 Mar 31

Stored cross-site scripting (XSS) in Pega Platform versions 8.1.0 through 25.1.0 allows authenticated administrative use
CVE-2026-1562 MEDIUM
4.6 Jul 15

Stored cross-site scripting in Pega Platform (Pega Infinity) versions 8.1.0 through 25.1.2 allows a high-privileged deve
CVE-2026-14337 MEDIUM
4.6 Aug 04

Stored cross-site scripting in Pega Platform (Pega Infinity) versions 23.1.0 through 25.1.3 allows a high-privileged dev

Same weakness CWE-606 – Unchecked Input for Loop Condition

View all
CVE-2026-62901 HIGH POC
7.5
CVE-2026-1519 HIGH POC
7.5
CVE-2024-34486 HIGH POC
7.5
CVE-2019-25624 MEDIUM POC
6.2
CVE-2026-71439 MEDIUM POC
5.3
CVE-2026-20301 HIGH
8.6
CVE-2026-23689 HIGH
7.7
CVE-2026-27689 HIGH
7.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-13761 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy