Improper authentication in Pegasystems Pega Infinity
Priority HIGH 74CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.
Why it matters now
EPSS 0.53841 99th percentileScored 2026-11-07
Fix Fixed Pega Infinity (Pegasystems): 8.5.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Pegasystems | Pega Infinity | 8.2.1 and later; before 8.5.2 | 8.5.2 | Patch available | CNA |
- Pega Infinity VendorPegasystems Affected 8.2.1 and later; before 8.5.2 Fixed in 8.5.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pega:infinity:*:*:*:*:*:*:*:* | 8.2.1 – 8.5.2 | Vulnerable | Pegasystems |
- cpe:2.3:a:pega:infinity:*:*:*:*:*:*:*:* Versions 8.2.1 – 8.5.2 Vulnerable ·Pegasystems
Remediation
- Fix · CNA Pega Infinity (Pegasystems) Fixed in 8.5.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-27651
- 2026-10-03 Alias added: GHSA-7px5-vqmh-8xj8
- 2026-10-23 EPSS moved to the 99th percentile and above
- 2026-10-25 EPSS moved to the 95th–99th percentile
- 2026-10-31 EPSS moved to the 99th percentile and above
References
More Pegasystems Infinity vulnerabilities
- TI-2022-08033 Deserialization of untrusted data in Pegasystems Pega Infinity CVSS 3.1CRITICAL 9.8
- TI-2022-08034 Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. CVSS 3.1CRITICAL 9.8
- TI-2024-09357 Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code CVSS 3.1CRITICAL 9.8
- TI-2021-09103 Forgotten password reset functionality for local accounts can be used to bypass local authentication checks. CVSS 3.1HIGH 7.8
- TI-2021-09102 Improper access control in Pega Infinity CVSS 3.1MEDIUM 6.6
- TI-2024-09930 Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search. CVSS 3.1MEDIUM 5.9
Sources
- CVE-2021-27651 · CVE Program
- CVE-2021-27651 · NVD
- FIRST EPSS
- GHSA-7px5-vqmh-8xj8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences