CVE-2026-1078CWE-284

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge.

High · published April 7, 2026

CVSS v4.0
7.2
EPSS
0%
Percentile
23.9
In the wild
Unconfirmed
What it is

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. A bad actor could create a website that includes malicious code. The vulnerability could occur if a Robot Runtime user navigates to the malicious website.

The record
Technical detail
CVSS v4.0
7.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
EPSS
0.00321 · 23.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-04-07T15:04Z
EPSS history
Timeline
  • 07 APR 15:04Z
    An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge.
    cvelistv5