CVE-2026-1078: An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge.

Severity: high (CVSS 7.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-07 · updated 2026-10-26
Weakness: CWE-284

Description

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. A bad actor could create a website that includes malicious code. The vulnerability could occur if a Robot Runtime user navigates to the malicious website.

Affected products

Pegasystems Pega Robot Studio: 22.1, R25

References

https://support.pega.com/support-doc/pega-security-advisory-a26-vulnerability-remediation-note

Get alerted when CVE-2026-1078 or the next vulnerability affects your stack