Pega Platform EUVD-2026-52686

Q: What is the CVSS score of EUVD-2026-52686?

EUVD-2026-52686 has a CVSS 4.0 base score of 4.6 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-14337 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-04 Pega

GHSA-rc9g-38jr-hhrj

XSS Pega Infinity Pegasystems

4.6

CVSS 4.0 · Vendor: Pega

Severity by source

Vendor (Pega) PRIMARY

4.6 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Developer-role access required (PR:H); victim must load the page (UI:R); stored XSS shifts scope to victim browser (S:C); impact limited to low C and I per CVSS 4.0 source data.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Pega).

CVSS VectorVendor: Pega

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 14:37 vuln.today

DescriptionCVE.org

Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

AnalysisAI

Stored cross-site scripting in Pega Platform (Pega Infinity) versions 23.1.0 through 25.1.3 allows a high-privileged developer-role user to inject persistent malicious JavaScript into a UI component, which then executes in the browser context of any user who subsequently views the affected interface. The attack requires both a developer-role account to plant the payload and victim user interaction to trigger it, substantially limiting realistic blast radius compared to typical stored XSS. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Pega Platform, marketed as Pega Infinity (CPE: cpe:2.3:a:pegasystems:pega_infinity), is an enterprise low-code application development and BPM platform used heavily in financial services, insurance, and government sectors. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), the root cause of which is insufficient sanitization or encoding of user-supplied data before it is stored and later rendered in the browser DOM. Because the payload is stored server-side, every subsequent page load by any user who visits the affected UI component re-executes the injected script without further attacker involvement. The specific UI component is not named in the advisory, but the developer-role requirement indicates the injection point is within platform development or configuration tooling rather than end-user-facing forms.

RemediationAI

Organizations should consult the Pega security advisory at https://support.pega.com/support-doc/pega-security-advisory-o26-vulnerability-remediation-note to obtain the specific patched version, as an exact fix release number is not confirmed in the available public data - patch availability is per vendor advisory only. As a compensating control where immediate patching is not possible, organizations should restrict developer-role access in Pega Platform to the minimum set of trusted personnel and audit existing developer accounts for unauthorized access. Additionally, enforcing Content Security Policy (CSP) headers on the Pega Platform deployment can limit the impact of any stored XSS by restricting script execution sources, though this requires platform-level or proxy-level configuration and may affect legitimate Pega UI functionality - test carefully before deployment. Monitoring developer activity logs within Pega for anomalous UI configuration changes provides detection capability while the patch is pending.