CVE-2026-14337

Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Pega Platform

Publication date: 2026-08-04

Last updated on: 2026-10-23

Assigner: Pegasystems Inc.

Description

Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-10-23

Generated

2026-11-08

AI Q&A

2026-08-04

EPSS Evaluated

2026-11-07

NVD

CVE-2026-14337

EUVD

EUVD-2026-52686

Affected Vendors & Products

Vendor	Product	Version / Range
pega	platform	From 23.1.0 (inc) to 25.1.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-14337 is a Stored Cross-site Scripting (XSS) vulnerability in Pega Platform versions 23.1.0 through 25.1.3. It requires a high privileged user with a developer role to exploit. The vulnerability allows malicious scripts to be stored on the platform and executed when other users interact with the affected component.

Detection Guidance

Detection requires checking Pega Platform versions 23.1.0 through 25.1.3. Review user roles for high-privileged developer access. Monitor for unusual script execution in UI components. No specific commands are provided in the resources.

Impact Analysis

This vulnerability can allow attackers with developer or admin access to inject malicious scripts into the Pega Platform. These scripts could steal user sessions, manipulate data, or perform unauthorized actions on behalf of users. It primarily affects users with high privileges but can impact other users if exploited.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, potentially violating GDPR (data protection) and HIPAA (healthcare data privacy). Compliance may be impacted if sensitive data is exposed or altered due to the XSS flaw.

Mitigation Strategies

Apply available hotfixes: HFIX-D1620 for 25.1.3, HFIX-D2061 for 24.2.5, or wait for patches for 24.1.5, 25.1.4, and 26.1.1. Pega Cloud users get automatic hotfixes. On-premises clients must download from My Security Hotfixes. No restart required after applying hotfixes.

Hi! I’m here to help you understand CVE-2026-14337. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...