Pega Platform CVE-2026-1562

Exploitation requires an authenticated account with the developer role in Pega Platform - a high-privilege condition (PR:H) that limits the attacker population to credentialed insiders or compromised developer accounts. Additionally, a victim user must interact with the affected UI component (UI:A) to trigger script execution. The attack is network-delivered (AV:N), so the attacker does not need local or adjacent network access, but does need valid developer credentials. What limits exploitation: the developer role is a non-default, provisioned entitlement in enterprise Pega environments; external unauthenticated attackers cannot exploit this directly; and the impact is scoped to the vulnerable system only (SC:N/SI:N/SA:N), meaning no lateral movement to other systems is implied by the vulnerability mechanics alone.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) scores 4.6 Medium, accurately reflecting the dual constraints of high-privilege prerequisite (PR:H) and required user interaction (UI:A). In practice, exploitation is gated behind obtaining a developer-role account, which in enterprise Pega deployments is typically a controlled, provisioned identity - not something an external attacker acquires trivially. The attack complexity is low once those prerequisites are met, but the prerequisites themselves are non-trivial barriers. No EPSS score was provided in the input data, preventing probability-of-exploitation quantification. No KEV listing and no public POC exist at time of analysis, reinforcing that this is not a priority for emergency patching outside of Pega developer environments. The limited VC:L/VI:L impact (no availability, no subsequent-system scope change) further confirms this is a contained risk rather than a critical breach vector. Security teams should prioritize this based on whether external parties hold developer-role access to their Pega tenants.

An authenticated user holding the Pega developer role navigates to the vulnerable UI component and submits a crafted payload containing malicious JavaScript, which the application stores without proper sanitization. When another user - potentially with higher privileges such as an administrator - later loads the affected page and interacts with the content (UI:A), their browser executes the injected script, potentially enabling session token theft or unauthorized actions within the Pega application context. No public proof-of-concept code has been identified, so exploitation currently requires manual crafting of the XSS payload.