CVE-2026-1563 Pega CVE debrief

Who should care

Users of Pega Platform versions 8.1.0 through 25.1.2, especially those with high privileges and developer roles, should be aware of this Reflected Cross-site scripting (XSS) vulnerability and take necessary precautions to defend against it. This includes reviewing the official CVE record, checking for vendor remediation, and monitoring for suspicious activity.

Technical summary

A Reflected Cross-site scripting (XSS) vulnerability exists in Pega Platform versions 8.1.0 through 25.1.2. The vulnerability is located in a user interface component and requires a high privileged user with a developer role to exploit. The vulnerability has a CVSS score of 4.8 and a severity of MEDIUM. To defend against this vulnerability, users should inventory and verify Pega Platform versions 8.1.0 through 25.1.2 are in use, check for and apply vendor remediation, implement compensating controls such as web application firewalls, and monitor for suspicious activity.

Defensive priority

Medium priority due to the requirement of high privileges and the nature of the vulnerability. Users should implement compensating controls such as web application firewalls and monitor for suspicious activity.

Recommended defensive actions

• Inventory and verify Pega Platform versions 8.1.0 through 25.1.2 are in use
• Check for and apply vendor remediation
• Implement compensating controls such as web application firewalls
• Monitor for suspicious activity
• Exception tracking and retest

Evidence notes

Evidence is based on official CVE and NVD records. Further verification is recommended due to limited source detail. The vulnerability requires a high privileged user with a developer role and is located in a user interface component of Pega Platform versions 8.1.0 through 25.1.2. Additional verification tasks include reviewing the official CVE record, checking for vendor remediation, and monitoring for suspicious activity.

Official resources