Pega Platform CVE-2026-13761

The CVSS 4.0 vector (PR:N, UI:N, AV:N, AC:L) confirms exploitation requires no authentication, no user interaction, and no elevated complexity - any network-reachable Pega Platform endpoint that processes the vulnerable loop-conditioned input is exploitable. The affected version range is broad (7.1.0 through 25.1.2), spanning over a decade of releases. No special configuration or non-default feature flag is stated as required by the description. Exploitation is limited by: network accessibility of the Pega instance (self-hosted deployments behind VPNs or firewalls are less exposed than internet-facing ones); the specific endpoint or workflow that processes the vulnerable loop input must be reachable and active; and cloud-managed Pega deployments may receive patches transparently, reducing the window.

The CVSS 4.0 score of 8.8 with AV:N/AC:L/AT:N/PR:N/UI:N represents a high-severity, frictionless attack: no account, no proximity requirement, and no victim interaction. The combination of VA:H (full availability loss on the vulnerable system) and VI:H (high integrity impact) elevates this above a simple DoS. However, several moderating signals should inform prioritization: no EPSS data was provided so exploitation probability cannot be quantified; the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis; and no public proof-of-concept code is referenced. The 'or other consequences' language in the description is vague and may indicate the vendor has not fully characterized secondary integrity effects. Internet-facing Pega deployments in the affected version range face the highest realistic risk; internally accessible deployments benefit from network-layer controls. The absence of KEV and POC pushes this from emergency to urgent-patching priority.

An unauthenticated remote attacker identifies an internet-facing Pega Platform instance running a version between 7.1.0 and 25.1.2, then submits a crafted HTTP request containing input designed to be used as a loop termination condition - providing a value (such as a very large integer, a negative bound, or a non-terminating expression) that causes the server-side loop to run indefinitely. The resulting CPU exhaustion degrades or completely denies service to legitimate users, and depending on the specific code path, may also corrupt in-progress transaction state.