Read the docs
TI-2026-00675 Aliases CVE-2026-0898GHSA-5c89-ppg6-hr22

Improper access control in Pegasystems Pega Robot Studio

Priority MEDIUM 41CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. This vulnerability does not affect Robot Runtime users. A bad actor could create a website that includes malicious code. The vulnerability may be exploited if a Pega Robot Studio developer is deceived into visiting this website during interrogation mode in Robot Studio.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00334 26th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PegasystemsPega Robot Studio22.1; R25—No fix listedCNA
  • Pega Robot Studio VendorPegasystems Affected 22.1; R25 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-0898
  2. 2026-10-03 Alias added: GHSA-5c89-ppg6-hr22

References

Other 1

  • TI-2021-09101 Improper authentication in Pegasystems Pega Infinity CVSS 3.1CRITICAL 9.8
  • TI-2022-08033 Deserialization of untrusted data in Pegasystems Pega Infinity CVSS 3.1CRITICAL 9.8
  • TI-2023-15393 Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials CVSS 3.1CRITICAL 9.8
  • TI-2019-12313 Pega Platform 8.2.1 allows LDAP injection because a username can contain a * character… CVSS 3.1CRITICAL 9.8
  • TI-2020-12137 pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an… CVSS 3.1CRITICAL 9.8
  • TI-2026-11602 Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of… CVSS 4.0HIGH 8.8
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences