CVE-2025-62180: Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.

Severity: high (CVSS 7.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-23 · updated 2026-10-06
Weakness: CWE-639

Description

Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.

Affected products

Pegasystems Pega Infinity: from 8.3.0 before Infinity 25.1.3 — fixed in Infinity 25.1.3

How to fix

Upgrade to a fixed version: Pegasystems Pega Infinity Infinity 25.1.3. Check the vendor advisory for mitigations.

References

https://support.pega.com/support-doc/pega-security-advisory-h26-vulnerability-remediation-note
https://support.pega.com/support-doc/pega-security-advisory-i25-vulnerability-remediation-note

Get alerted when CVE-2025-62180 or the next vulnerability affects your stack