Pega Platform CVE-2026-1563

Q: What is the CVSS score of CVE-2026-1563?

CVE-2026-1563 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44727 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-15 Pega

GHSA-pcfw-jm9h-vg4m

XSS Pega Infinity

4.8

CVSS 4.0 · Vendor: Pega

Severity by source

Vendor (Pega) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Network-delivered reflected XSS requiring developer credentials (PR:H), victim interaction (UI:R), and scope change to victim browser (S:C); no availability impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Pega).

CVSS VectorVendor: Pega

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 17:15 vuln.today

DescriptionCVE.org

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

AnalysisAI

Reflected cross-site scripting in Pega Platform (Pega Infinity) versions 8.1.0 through 25.1.2 allows a high-privileged attacker holding a developer role to inject malicious scripts into a user interface component, which execute in a victim's browser upon interaction. The CVSS 4.0 score of 4.8 (Medium) reflects meaningful constraints: exploitation requires both developer-level authentication and a victim's active interaction with a crafted link or payload. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Pega Platform, marketed as Pega Infinity (CPE: cpe:2.3:a:pegasystems:pega_infinity:*:*:*:*:*:*:*:*), is an enterprise low-code BPM and CRM platform. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS), meaning the application accepts attacker-controlled input and echoes it unsanitized into an HTTP response that is immediately reflected back to the requesting browser. Because this occurs in a developer-facing UI component, the affected surface is the Pega authoring or administration interface rather than end-user-facing portal pages. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) confirms the attack is network-delivered, low-complexity once access is obtained, requires no specific attack target configuration, but demands high-privilege credentials and victim interaction.

RemediationAI

Organizations should consult the Pega Security Advisory E26 at https://support.pega.com/support-doc/pega-security-advisory-e26-vulnerability-remediation-note for the vendor-recommended patch or upgrade path. An exact fixed version number was not independently confirmable from the available intelligence - the advisory should be consulted directly to identify the minimum patched release. As a compensating control, restrict developer-role assignments to the minimum required personnel and enforce multi-factor authentication on developer accounts to limit the population of users who could act as attackers. Review and audit developer-role membership in Pega access control policies. Browser-level controls such as a strict Content-Security-Policy header on Pega-served pages would limit the impact of any successful XSS by constraining script execution context, though this requires platform-level or reverse-proxy configuration and may affect Pega's own UI functionality - test before deploying broadly.