Pega Platform Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Pega Platform, affecting versions 8.1.0 prior to 25.1.0. This vulnerability resides within a user interface component and requires an administrative user with extensive access rights to exploit. The issue allows for the injection of malicious scripts, which could be executed in the context of the user interface.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can update to Pega Platform version 24.1.4, 24.2.4 (targeted for March 2026), or 25.1.0 (with 25.1.1 available) to address this vulnerability. For details on keeping Pega environments up to date, consult the Pega Infinity Patch Calendar.