Advisoriesby IbisPegasystemsCVE-2026-10754
Pegasystems Pega Infinity: improper signature check
Fix: upgrade to Infinity 25.1.3 or later
Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Pega Infinity Product | >= 8.5.0, < Infinity 25.1.3 | Infinity 25.1.3 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-347