PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-62184 Pega CVE debrief

CVE-2025-62184 is a Stored Cross-site Scripting vulnerability in Pega Platform versions 8.1.0 through 25.1.0. The vulnerability requires an administrative user with extensive access rights, resulting in low impact to Confidentiality and no impact to Integrity. The vulnerability class is Stored Cross-site Scripting (XSS) in a user interface component. The likely operational impact is low, given the required administrative access. The source-confidence limits are based on the CVE record and NVD entry.

Vendor
Pega
Product
Pega Platform
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Administrators and users of Pega Platform versions 8.1.0 through 25.1.0 should be aware of this vulnerability and take necessary precautions to mitigate the risk. The affected operator is the administrative user, and the platform is Pega Platform. The vulnerability-management impact is low, given the required administrative access. The security-team impact is medium, as the vulnerability requires attention and mitigation.

Technical summary

The vulnerability is a Stored Cross-site Scripting (XSS) in a user interface component of Pega Platform versions 8.1.0 through 25.1.0. The Common Vulnerabilities and Exposures (CVE) score is 4.8, with a Medium severity level. The vulnerability requires an administrative user with extensive access rights, resulting in low impact to Confidentiality and no impact to Integrity. The defensive impact is medium, as the vulnerability requires an administrative user with extensive access rights.

Defensive priority

Medium priority, as the vulnerability requires an administrative user with extensive access rights.

Recommended defensive actions

  • Apply the vendor's remediation note as described in the Pega Security Advisory.
  • Restrict access to the affected user interface component.
  • Monitor for suspicious activity and implement compensating controls.
  • Perform inventory checks to identify affected systems.
  • Exception tracking and retesting should be performed after applying the remediation.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-03-31T18:16:44.423Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. The vulnerability is a Stored Cross-site Scripting (XSS) in a user interface component of Pega Platform versions 8.1.0 through 25.1.0. The Common Vulnerabilities and Exposures (CVE) score is 4.8, with a Medium severity level. The vulnerability requires an administrative user with extensive access rights, resulting in low impact to Confidentiality and no impact to Integrity. The source details are limited, and defenders should verify the affected scope and vendor guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-62184 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-62184

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-62184 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-62184

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.