{"id":"CVE-2025-8681","title":"Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component","summary":"Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component.  Requires a high privileged user with a developer role.","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","cwe":["CWE-79"],"vendor":"pega","product":"pega_platform","affected":["pega_platform >= 7.1.0, < 23.1.5","pega_platform >= 24.1.0, < 24.1.3","pega_platform >= 24.2.0, < 24.2.2"],"patched":["pega_platform 24.2.2"],"published":"2025-09-10","updated":"2026-09-26","sourceUpdated":"2026-09-26T00:10:00.127","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-8681","references":[{"url":"https://support.pega.com/support-doc/pega-security-advisory-g25-vulnerability-remediation-note","label":"security@pega.com"}],"tags":["nvd"],"epss":0.00195,"epssPercentile":0.08154,"ingestedAt":"2026-09-26T00:22:39.914Z","slug":"CVE-2025-8681","body":"## Overview\n\nPega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component.  Requires a high privileged user with a developer role.\n\n## Affected\n\n- `pega_platform >= 7.1.0, < 23.1.5`\n- `pega_platform >= 24.1.0, < 24.1.3`\n- `pega_platform >= 24.2.0, < 24.2.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `pega_platform 24.2.2`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}