CVE-2026-14337
Received Received - Intake

Stored XSS in Pega Platform

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: Pegasystems Inc.

Description
Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-14337
EUVD
EUVD-2026-52686

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pega platform From 23.1.0 (inc) to 25.1.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-14337 is a Stored Cross-site Scripting (XSS) vulnerability in Pega Platform versions 23.1.0 through 25.1.3. It requires a high privileged user with a developer role to exploit. The vulnerability allows malicious scripts to be stored on the platform and executed when other users interact with the affected component.

Detection Guidance

Detection requires checking Pega Platform versions 23.1.0 through 25.1.3. Review user roles for high-privileged developer access. Monitor for unusual script execution in UI components. No specific commands are provided in the resources.

Impact Analysis

This vulnerability can allow attackers with developer or admin access to inject malicious scripts into the Pega Platform. These scripts could steal user sessions, manipulate data, or perform unauthorized actions on behalf of users. It primarily affects users with high privileges but can impact other users if exploited.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, potentially violating GDPR (data protection) and HIPAA (healthcare data privacy). Compliance may be impacted if sensitive data is exposed or altered due to the XSS flaw.

Mitigation Strategies

Apply available hotfixes: HFIX-D1620 for 25.1.3, HFIX-D2061 for 24.2.5, or wait for patches for 24.1.5, 25.1.4, and 26.1.1. Pega Cloud users get automatic hotfixes. On-premises clients must download from My Security Hotfixes. No restart required after applying hotfixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14337. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart