Received C21 Security Advisory from Pega today and trying to understand the criteria whether this issue impacts our environments or not. Does anybody has more information regarding what is the actual issue.

Is Pega referring local authentication as the "PRServlet" default login which has both authentication and authorization happens in pega? and is that Authentication being referred as local authentication?

If multi-factor authentication is utilized in combination with local authentication - Does it referring the custom authentication using Authentication Service from Pega platform and Authorization happens in Pega by Operator validation?

Pega continually works to implement security controls designed to protect client environments. With this focus, Pega has identified a high severity security vulnerability in versions 8.2.1 – 8.6.1 of Pega Infinity(tm).

Pega has created the C21 Hotfix for each relevant version to remediate this issue. You are receiving this communication because you are a designated security contact for your organization, and we believe your organization is running one of the impacted versions of Pega Infinity.

Criteria to determine if systems are impacted:

If the system(s) in question does not use local authentication at all, this mitigates the problem.

If one-time password / ‘forgot password’ functionality is not enabled for locally authenticated users, this mitigates the problem.

If multi-factor authentication is utilized in combination with local authentication, this mitigates the problem.