Executive Summary - Action Required
Pega regularly implements security controls designed to safeguard client environments. As part of these efforts, Pega will release patch updates and hotfixes addressing two high-severity and four medium-severity security vulnerabilities in Pega Platform.
To date, Pega is not aware of any compromise resulting from these vulnerabilities; however, remediation should be implemented to maintain security.
|
Advisory |
Description |
Patch Remediation |
Hotfix Remediation |
|---|---|---|---|
|
Jackson-Databind Vulnerabilities |
Unsafe deserialization vulnerabilities |
24.1.5 Patch Release 25.1.4 Patch Release 26.1.1 Patch Release
|
23.1.5 - HFIX-D2576 24.1.4 - HFIX-D2577 24.2.5 - HFIX-D2578 25.1.3 - HFIX-D2579 26.1.0 - HFIX-D2580 |
Dates for upcoming patch releases can be found here: Pega Infinity Patch Calendar.
Information regarding the availability of the patch releases will be publicly posted on Pega Support Center on October 26, 2026. We request that clients not discuss this in public forums until after this issue has been publicly posted to enable all customers to have adequate time to apply the necessary patches and/or hotfixes.
Impact
CVE-2026-54512 and CVE-2026-54513: Unsafe deserialization that allows attackers to bypass polymorphic type restrictions, potentially enabling unauthorized class loading and remote code execution.
CVE-2026-54514: Deserialization of attacker-controlled network addresses can trigger unintended DNS lookups before application validation.
CVE-2026-54515, CVE-2026-59888, and CVE-2026-59889: Deserialization can bypass property and view restrictions, allowing unauthorized fields to be set.
Issue Details
|
Issue Details |
Unsafe deserialization |
|---|---|
|
Software/Product |
Pega Platform |
|
Affected Version(s) |
From 23.1 to 26.1 |
|
CVE |
High: CVE-2026-54512 CVE-2026-54513 , Medium: CVE-2026-54514, CVE-2026-54515, CVE-2026-59888, CVE-2026-59889
|
|
CVSS Rating |
Between Medium 5.3 and High 8.1 |
|
Description |
Unsafe deserialization |
As a best practice, you should update your Pega environment to the latest release to take advantage of the latest features, capabilities, security, and bug fixes. See Keeping Current with Pega for details.
Known vulnerability status
The same vulnerabilities found in Jackson-Databind library are also present in the Parquet-Jackson library as part of Pega Platform. The Apache community has released a Parquet version that addresses this vulnerability. However, this is not yet included as it was provided recently. Pega is targeting hotfixes to address the Parquet-Jackson vulnerabilities the week of August 31st. Clients will be notified via a pulse post with this same Client Advisory.
Obtaining your Hotfixes
Hotfixes are being created only for the patch releases listed above, under Hotfix Remediation. A restart is needed after hotfix installation.
We will not provide hotfixes on prior versions of Pega Platform.
-
Pega Cloud® and United States Pega Cloud for Government (PCFG) clients, using the versions listed above, will have hotfixes applied proactively, with Cloud Maintenance (CM) cases detailing the schedule.
-
On-premises or client-managed cloud clients should check the table above for applicable hotfixes and download them directly from My Security Hotfixes on My Pega.
If you have questions or concerns, please raise a Support Ticket in My Support Portal.