What’s Vulnerable › Products

Pegasystems Pega Infinity vulnerabilities

36 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.

Check whether your Pegasystems Pega Infinity version is affected

Latest Pegasystems Pega Infinity vulnerabilities

• CVE-2026-13761 — Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping. (CVSS 8.8)
• CVE-2026-10754 — Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls. (CVSS 8.6)
• CVE-2026-14337 — Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 4.6)
• CVE-2026-1563 — Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 4.8)
• CVE-2026-1562 — Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 4.8)
• CVE-2025-62180 — Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs. (CVSS 7.1)
• CVE-2026-1711 — Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 4.8)
• CVE-2026-1564 — Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 4.8)
• CVE-2025-62184 — Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. (CVSS 3.4)
• CVE-2025-62183 — Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality and Integrity are low. (CVSS 4.8)
• CVE-2025-62182 — Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file. (CVSS 5.3)
• CVE-2025-62181 — Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not. (CVSS 5.3)
• CVE-2025-9559 — Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data (CVSS 6.5)
• CVE-2025-8681 — Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component (CVSS 5.4)
• CVE-2025-2161 — (CVSS 6.1)
• CVE-2025-2160 — (CVSS 6.1)
• CVE-2024-12211 — (CVSS 5.4)
• CVE-2023-50168 — (CVSS 7.7)
• CVE-2023-50167 — (CVSS 6.1)
• CVE-2023-4843 — (CVSS 4.8)
• CVE-2023-32090 — (CVSS 9.8)
• CVE-2023-28094 — (CVSS 9.8)
• CVE-2023-26465 — (CVSS 6.1)
• CVE-2022-35656 — (CVSS 4.5)
• CVE-2022-35655 — (CVSS 6.1)