Skip to main content

Pega Platform CVE-2026-14337

| EUVDEUVD-2026-52686 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-04 Pega GHSA-rc9g-38jr-hhrj
XSS Pega Infinity
4.6
CVSS 4.0 · Vendor: Pega
Share

Severity by source

Vendor (Pega) PRIMARY
4.6 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.8 MEDIUM

Developer-role access required (PR:H); victim must load the page (UI:R); stored XSS shifts scope to victim browser (S:C); impact limited to low C and I per CVSS 4.0 source data.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Pega).

CVSS VectorVendor: Pega

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
A
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 04, 2026 - 14:37 vuln.today

DescriptionCVE.org

Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

AnalysisAI

Stored cross-site scripting in Pega Platform (Pega Infinity) versions 23.1.0 through 25.1.3 allows a high-privileged developer-role user to inject persistent malicious JavaScript into a UI component, which then executes in the browser context of any user who subsequently views the affected interface. The attack requires both a developer-role account to plant the payload and victim user interaction to trigger it, substantially limiting realistic blast radius compared to typical stored XSS. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to hold an active, authenticated Pega Platform account with the developer role - a high-privilege level (PR:H in CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 4.6 (Medium) reflects the significant mitigating factors present: PR:H (requires a developer-role account), UI:A (victim interaction required to trigger the payload), and VC:L/VI:L (limited confidentiality and integrity impact with no availability impact and no subsequent-system scope change). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Organizations should consult the Pega security advisory at https://support.pega.com/support-doc/pega-security-advisory-o26-vulnerability-remediation-note to obtain the specific patched version, as an exact fix release number is not confirmed in the available public data - patch availability is per vendor advisory only. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Pega Infinity

View all
CVE-2026-13761 HIGH
8.8 Aug 28

Pega Platform (marketed as Pega Infinity) versions 7.1.0 through 25.1.2 expose a network-accessible, unauthenticated att
CVE-2026-10754 HIGH
8.6 Aug 10

Cryptographic signature validation failure in Pega Platform (Pega Infinity) versions 8.5.0 through 25.1.2 enables low-pr
CVE-2025-62180 HIGH
7.1 Jun 23

Authorization bypass in Pega Platform versions 8.3.0 through Infinity 25.1.2 allows authenticated users to access additi
CVE-2026-1564 MEDIUM
5.1 Apr 15

HTML injection in Pega Platform 8.1.0 through 25.1.1 allows an authenticated high-privileged user with developer role to
CVE-2026-1563 MEDIUM
4.8 Jul 15

Reflected cross-site scripting in Pega Platform (Pega Infinity) versions 8.1.0 through 25.1.2 allows a high-privileged a
CVE-2026-1711 MEDIUM
4.8 Apr 15

Stored cross-site scripting in Pega Infinity allows high-privileged users with developer roles to inject scripts in the

CVE-2025-62184 MEDIUM
4.8 Mar 31

Stored cross-site scripting (XSS) in Pega Platform versions 8.1.0 through 25.1.0 allows authenticated administrative use
CVE-2026-1562 MEDIUM
4.6 Jul 15

Stored cross-site scripting in Pega Platform (Pega Infinity) versions 8.1.0 through 25.1.2 allows a high-privileged deve

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-14337 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy