PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-14337 Pegasystems CVE debrief

A high-privileged user with a developer role can exploit a Stored Cross-site scripting (XSS) vulnerability in Pega Platform versions 23.1.0 through 25.1.3. This vulnerability affects the user interface component. The vulnerability requires verification of exposure and prioritization of remediation. Defenders responsible for Pega Platform deployments should assess their exposure and prioritize verification. The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation, impact, and remediation may be limited.

Vendor
Pegasystems
Product
Pega Infinity
CVSS
MEDIUM 4.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-04
Original CVE updated
2026-10-23
Advisory published
2026-08-04
Advisory updated
2026-10-23

Who should care

Defenders responsible for Pega Platform deployments, especially those with high-privileged developer roles, should assess exposure and prioritize verification.

Why it matters

Defenders should care about CVE-2026-14337 because it affects Pega Platform deployments, particularly those with high-privileged developer roles, and requires verification of exposure and prioritization of remediation.

  • Potential for XSS attacks in user interface components
  • Need for input validation and output encoding
  • Importance of restricting developer role access
  • Verification of Pega Platform version and updates

Technical summary

Pega Platform versions 23.1.0 through 25.1.3 are affected by a Stored Cross-site scripting (XSS) vulnerability in a user interface component. The vulnerability requires a high privileged user with a developer role. The vulnerability affects the user interface component and requires input validation and output encoding. Defenders should prioritize verifying exposure in their Pega Platform deployments, especially where high-privileged developer roles exist, and assess the feasibility of XSS attacks.

Defensive priority

Defenders should prioritize verifying exposure in their Pega Platform deployments, especially where high-privileged developer roles exist, and assess the feasibility of XSS attacks.

Recommended defensive actions

  • Verify Pega Platform version and check for updates
  • Restrict developer role access
  • Implement input validation and output encoding
  • Monitor for suspicious activity

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, additional information on exploitation, impact, and remediation may be limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-14337 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-14337

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-14337 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-14337

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.