Stored Cross-site Scripting Vulnerability in Pega Platform by Pega Systems
CVE-2026-14337

4.6MEDIUM

Key Information:

Vendor

Pegasystems

Status
Pega Infinity
Vendor
CVE Published:
4 August 2026

What is CVE-2026-14337?

The Pega Platform versions 23.1.0 through 25.1.3 are susceptible to a Stored Cross-site Scripting (XSS) vulnerability located in a user interface component. This vulnerability requires a user with high privileges, specifically those holding a developer role, to exploit it effectively. If successfully executed, it could lead to unauthorized actions or data exposure within the platform, thus necessitating prompt remediation to protect sensitive information and maintain system integrity.

Affected Version(s)

Pega Infinity 23.1.0

References

https://support.pega.com/support-doc/pega-security-adviso...

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrea Intilangelo, independent ethical hacker/security researcher
.