Pega Platform EUVD-2026-44727

Exploitation requires the attacker to hold an active, authenticated session in Pega Platform with a developer role assigned - this is a high-privilege, non-default role not granted to ordinary end users. Additionally, a victim must interact with the attacker-crafted content (UI:P), meaning the attacker must deliver a malicious link or trigger a page load through social engineering; the vulnerability cannot be exploited passively or without victim interaction. Exploitation is limited to Pega Infinity versions 8.1.0 through 25.1.2; earlier and later versions are not listed as affected. The attack surface is confined to the developer-facing UI component rather than publicly exposed portal or API endpoints, further limiting exposure to internal or authenticated network segments in most enterprise deployments.

The CVSS 4.0 score of 4.8 (Medium) is well-calibrated for this vulnerability. PR:H constrains the attacker population to authenticated users with developer roles - a small, typically trusted group - which substantially reduces the real-world risk compared to unauthenticated XSS. UI:P further requires the victim to take an action (e.g., click a crafted URL), making opportunistic mass exploitation implausible. Impact metrics VC:L/VI:L with no availability impact (VA:N) and no subsequent-system impact (SC:N/SI:N/SA:N) indicate the blast radius is limited to confidentiality and integrity of the vulnerable system at a low level - consistent with session token theft or limited DOM manipulation rather than full account takeover or persistent backdoors. No EPSS data was provided in the source intelligence. No CISA KEV listing exists. No public POC has been identified. The overall risk priority is low-to-medium: relevant primarily as an insider threat or for environments where developer accounts may be compromised, rather than an externally exploitable attack surface.

A Pega developer who is authenticated to the platform (or whose credentials have been compromised) crafts a malicious URL targeting the vulnerable UI component, embedding a reflected XSS payload in a query parameter. The attacker sends this URL to another Pega user - for example, a business administrator - via phishing or internal messaging; when the victim clicks the link and the page renders, the injected script executes in the victim's browser session, potentially harvesting the victim's Pega session token or performing actions on their behalf. No public proof-of-concept exploit was identified at time of analysis.