CVE-2026-14337CWE-79cross-site-scripting

CVE-2026-14337

published August 4, 2026

CVSS
4.6
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

The record
Technical detail
CVSS
4.6 · NONE
CVSS v4.0
Not supplied
EPSS
0.00418 · 35.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-04T18:16Z
References (1)
https://support.pega.com/support-doc/pega-security-advisory-o26-vulnerability-remediation-note · [email protected]
EPSS history
Timeline
  • 04 AUG 13:48Z
    Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
    cvelistv5