Pega Platform EUVD-2025-210309

Attacker must possess valid authenticated credentials to the target Pega Platform instance (PR:L) and network reachability to its web interface; no user interaction or special tooling is required, and the attack works against default Pega Infinity deployments in the 8.3.0 through Infinity 25.1.2 range. Exploitation is limited by the need for at least one working account on the tenant, knowledge or guessability of the Pega URL parameter / object ID scheme used to reference target records, and the scope of data the application exposes via those crafted URLs - impact is confined to confidentiality of additional accessible data plus a low availability effect, not integrity or full takeover.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L) describes a network-reachable, low-complexity attack requiring only low-privilege authentication and no user interaction, producing high confidentiality impact - consistent with a serious IDOR-style data exposure rather than full system compromise. No EPSS score, KEV listing, SSVC decision, or public POC was provided, and the issue was self-reported by Pega rather than appearing in CISA KEV, suggesting credible but not confirmed widespread exploitation. Real-world risk is meaningful because Pega tenants frequently hold sensitive case data (PII, financial, healthcare workflows) and any legitimate user account becomes a launchpad, but exploitation is bounded by the need for valid credentials and knowledge of the Pega URL/ID scheme.

A logged-in Pega user with a routine low-privilege role browses to a case or data view, observes the case ID or pyID parameter in the URL, and increments or substitutes it with another known or guessed identifier. The server returns data belonging to a different user or case without re-checking ownership, allowing the attacker to harvest sensitive case content across the tenant. No public exploit identified at time of analysis, but the technique is trivial and well-known for CWE-639 IDORs.