PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-62184 Pega CVE debrief

CVE-2025-62184 is a Stored Cross-site Scripting vulnerability in Pega Platform versions 8.1.0 through 25.1.0. The vulnerability requires an administrative user with extensive access rights, resulting in low impact to Confidentiality and no impact to Integrity. The vulnerability class is Stored Cross-site Scripting (XSS) in a user interface component. The likely operational impact is low, given the required administrative access. The source-confidence limits are based on the CVE record and NVD entry.

Vendor
Pega
Product
Pega Platform
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Administrators and users of Pega Platform versions 8.1.0 through 25.1.0 should be aware of this vulnerability and take necessary precautions to mitigate the risk. The affected operator is the administrative user, and the platform is Pega Platform. The vulnerability-management impact is low, given the required administrative access. The security-team impact is medium, as the vulnerability requires attention and mitigation.

Technical summary

The vulnerability is a Stored Cross-site Scripting (XSS) in a user interface component of Pega Platform versions 8.1.0 through 25.1.0. The Common Vulnerabilities and Exposures (CVE) score is 4.8, with a Medium severity level. The vulnerability requires an administrative user with extensive access rights, resulting in low impact to Confidentiality and no impact to Integrity. The defensive impact is medium, as the vulnerability requires an administrative user with extensive access rights.

Defensive priority

Medium priority, as the vulnerability requires an administrative user with extensive access rights.

Recommended defensive actions

  • Apply the vendor's remediation note as described in the Pega Security Advisory.
  • Restrict access to the affected user interface component.
  • Monitor for suspicious activity and implement compensating controls.
  • Perform inventory checks to identify affected systems.
  • Exception tracking and retesting should be performed after applying the remediation.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-03-31T18:16:44.423Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. The vulnerability is a Stored Cross-site Scripting (XSS) in a user interface component of Pega Platform versions 8.1.0 through 25.1.0. The Common Vulnerabilities and Exposures (CVE) score is 4.8, with a Medium severity level. The vulnerability requires an administrative user with extensive access rights, resulting in low impact to Confidentiality and no impact to Integrity. The source details are limited, and defenders should verify the affected scope and vendor guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-03-31T18:16:44.423Z and has not been modified since then. The NVD entry is currently Analyzed.