Pega Infinity EUVD-2025-209147

Despite the CVSS 4.8 score, multiple factors substantially mitigate real-world risk. The CVSS vector indicates PR:H (requires high privilege - administrative role) and UI:P (requires user interaction - a victim must view the injected content), creating dual gates against exploitation. EPSS exploitation probability data is not provided, but the requirement for both administrative access and victim interaction strongly suggests low practical exploitability despite the vulnerability being stored (persistent). The vulnerability carries no integrity or availability impact (VI:N, VA:N), only low confidentiality impact (VC:L), limiting the attacker's ability to cause system compromise. There is no KEV (CISA Known Exploited Vulnerabilities) status and no publicly available POC identified, indicating this is not a priority internet-wide threat. Organizations using Pega should treat this as a maintenance-level patch rather than an emergency - prioritize patching administrative interface security but deprioritize relative to network-accessible vulnerabilities with lower attack complexity or unauthenticated access.

A disgruntled or compromised Pega administrator with access to UI component customization injects malicious JavaScript into a form field or dashboard widget that is widely viewed by other users. When other employees or customers interact with the affected page, the stored script executes in their browsers, potentially exfiltrating session tokens or sensitive form data. However, given the high-privilege requirement (administrative access) and the need for a victim to interact with the component, such attacks are typically limited to insider threats or follow-up exploitation after an admin account compromise, not opportunistic internet-wide attacks.