Pega Platform CVE-2026-14337

Exploitation requires the attacker to hold an active, authenticated Pega Platform account with the developer role - a high-privilege level (PR:H in CVSS 4.0). This is not a default end-user role and would typically be assigned only to application developers or platform administrators. Additionally, successful payload execution requires a second user (victim) to actively navigate to or load the affected UI component (UI:A), meaning the attacker cannot force execution independently. Exploitation is further limited to Pega Platform deployments running versions 23.1.0 through 25.1.3; environments on earlier or later versions are not confirmed affected. There is no indication this flaw can be exploited without authenticated developer access, and no evidence of exploitation via network-accessible unauthenticated paths.

The CVSS 4.0 score of 4.6 (Medium) reflects the significant mitigating factors present: PR:H (requires a developer-role account), UI:A (victim interaction required to trigger the payload), and VC:L/VI:L (limited confidentiality and integrity impact with no availability impact and no subsequent-system scope change). These signals combine to indicate a relatively constrained real-world risk profile. There is no EPSS score provided in the input, no KEV listing, and no known public exploit, all of which align with the moderate severity rating. The principal concern is insider threat or compromised developer accounts being used to plant persistent payloads targeting other platform users, including potentially lower-privileged operators or end users. This is not a zero-interaction, externally reachable flaw - an attacker must first obtain developer-level access to Pega Platform, making opportunistic mass exploitation implausible. The limited impact metrics (VC:L/VI:L) also suggest the XSS cannot directly exfiltrate full data sets or achieve persistent server-side compromise, constraining the damage ceiling even in a successful attack.

An attacker with a compromised or malicious developer-role account in Pega Platform navigates to the vulnerable UI component and injects a JavaScript payload that is stored server-side. When any other platform user (for example, a business analyst or administrator) later opens the affected interface, their browser executes the stored script, potentially harvesting their session cookie or Pega authentication token and forwarding it to an attacker-controlled endpoint. No public proof-of-concept code has been identified, but the attack technique is well-understood and straightforward for anyone with developer access and basic XSS knowledge.