CVE-2026-0898

CRITICAL EPSS 23.8%

Published Mar 23, 20263mo ago · Modified Jun 17, 20262w ago

9.0 CVSS 4.0

Critical

Published Mar 23, 2026 3mo ago

Last Modified Jun 17, 2026 2w ago

Description

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. This vulnerability does not affect Robot Runtime users. A bad actor could create a website that includes malicious code. The vulnerability may be exploited if a Pega Robot Studio developer is deceived into visiting this website during interrogation mode in Robot Studio.

CVSS Details

Base Score

9.0

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction P

Scope X

Threat Intelligence

EPSS Exploit Probability

23.8% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-284

References 1

support.pega.com https://support.pega.com/support-doc/pega-security-advisory-p25-vulnerability-remediation-note

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.