Pega Platform CVE-2026-1562

Q: What is the CVSS score of CVE-2026-1562?

CVE-2026-1562 has a CVSS 4.0 base score of 4.6 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44726 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-15 Pega

GHSA-9j28-r64w-w53x

XSS Pega Infinity Pegasystems

4.6

CVSS 4.0 · Vendor: Pega

Severity by source

Vendor (Pega) PRIMARY

4.6 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Developer-role requirement drives PR:H; stored XSS scope-changes to victim browser (S:C); limited C:L/I:L from script execution; no availability impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Pega).

CVSS VectorVendor: Pega

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 17:15 vuln.today

DescriptionCVE.org

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

AnalysisAI

Stored cross-site scripting in Pega Platform (Pega Infinity) versions 8.1.0 through 25.1.2 allows a high-privileged developer-role user to inject persistent malicious scripts into a UI component, which execute in the browser context of other users who interact with the affected interface. The CVSS 4.0 score of 4.6 (Medium) reflects the constrained impact - limited confidentiality and integrity exposure with no availability impact - consistent with the PR:H and UI:A prerequisites that substantially reduce real-world risk. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode user-supplied data before rendering it in a web interface, enabling script injection that persists in the application's data store and executes in victims' browsers on subsequent page loads. The affected product is Pega Infinity - Pegasystems' enterprise low-code application development and BPM platform - identified by CPE cpe:2.3:a:pegasystems:pega_infinity:*:*:*:*:*:*:*:*. The vulnerable component is described as a user interface element accessible to users holding the developer role, indicating the injection point resides within the platform's development or configuration layer rather than a publicly-exposed end-user surface. Stored XSS in developer tooling contexts often targets administrative sessions, potentially enabling session hijacking or privilege escalation within the application.

RemediationAI

Consult and apply the guidance in the Pega security advisory at https://support.pega.com/support-doc/pega-security-advisory-e26-vulnerability-remediation-note, which is the authoritative source for patch or upgrade instructions. An exact fixed version number is not independently confirmed from the available data - organizations should verify the target upgrade version directly from the advisory before proceeding. As a compensating control pending patching, restrict or audit developer-role assignments to only trusted internal personnel, as the vulnerability requires this elevated permission to exploit. Additionally, reviewing Content Security Policy (CSP) headers on the Pega deployment can limit the impact of any executed XSS by restricting script sources, though CSP alone does not eliminate the stored payload. Note that restricting developer-role access may impair legitimate application development workflows.