Deserialization of untrusted data in Pegasystems Pega Infinity
Priority MEDIUM 56CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.
Summary
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture.
Why it matters now
EPSS 0.12191 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Pega Infinity (Pegasystems): 8.7.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Pegasystems | Pega Infinity | 8.1.0 and later; before 8.7.3 | 8.7.3 | Patch available | CNA |
- Pega Infinity VendorPegasystems Affected 8.1.0 and later; before 8.7.3 Fixed in 8.7.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pega:infinity:*:*:*:*:*:*:*:* | 8.1.0 to before 8.7.3 | Vulnerable | Pegasystems |
- cpe:2.3:a:pega:infinity:*:*:*:*:*:*:*:* Versions 8.1.0 to before 8.7.3 Vulnerable ·Pegasystems
Remediation
- Fix · CNA Pega Infinity (Pegasystems) Fixed in 8.7.3
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24082
- 2026-10-03 Alias added: GHSA-3crj-j3hg-7v57
References
More Pegasystems Infinity vulnerabilities
- TI-2021-09101 Improper authentication in Pegasystems Pega Infinity CVSS 3.1CRITICAL 9.8
- TI-2022-08034 Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. CVSS 3.1CRITICAL 9.8
- TI-2024-09357 Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code CVSS 3.1CRITICAL 9.8
- TI-2021-09103 Forgotten password reset functionality for local accounts can be used to bypass local authentication checks. CVSS 3.1HIGH 7.8
- TI-2021-09102 Improper access control in Pega Infinity CVSS 3.1MEDIUM 6.6
- TI-2024-09930 Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search. CVSS 3.1MEDIUM 5.9
Sources
- CVE-2022-24082 · CVE Program
- CVE-2022-24082 · NVD
- FIRST EPSS
- GHSA-3crj-j3hg-7v57 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences