Pega continually works to implement security controls designed to protect client environments. With this focus, Pega has identified a medium security vulnerability in all versions of Pega platform.  Pega has created the A22 Hotfix for each relevant version to remediate this issue.  

Pega has reassessed the impact of the vulnerability based on additional testing.   A22 has been re-scored as medium on the CVSS scale. The re-scoring considered that the user must be an authenticated trusted developer. Based on the revised score, Pega is no longer mandating A22 and is leaving the decision to apply A22 to our clients.   

As was communicated previously regarding the A22 hotfix, Pega has explored alternative options to secure your application. As a result, Pega is releasing a new set of A22 hotfixes. Pega Cloud® environments running the relevant Pega versions will have the hotfix proactively installed by Pega.  

If you are an on–premises client, and choose to apply the A22 Hotfix, please review the table below to determine which hotfix corresponds to your Pega Platform installation. Once you have determined the appropriate hotfix ID, please submit a hotfix request using  My Support Portal.   

Clients should deploy the hotfix in a lower environment and test there before propagating across systems. Pega recommends that the hotfix should NOT be committed until you have validated any impact. 

As with all hotfixes, please make sure you have appropriate backups.  

Pega will be providing more detailed advice to clients via their Client Advisory [CAD-] cases in My Support Portal.

Clients on version 7.2.2, who take HFIX-83159, must follow the steps provided to ensure that the hotfix and its dependencies are installed correctly. 

• HFIX-31757 requires manual steps.  Please see:  BouncyCastle support  - HFIX31757 - Pega version 7.2.2

Clients running a Pega version prior to 7.2 are required to upgrade to a version greater than 7.2. If an upgrade is not feasible at this time, please contact GCS support to discuss other options. 

As always, we recommend clients review our  Security Checklist regularly. 

This post has been updated 7 September 2022

• Added the following link: BouncyCastle support  - HFIX31757 - Pega version 7.2.2

This post has been updated on 28 June 2022, updates include: 

• Added 8.6.4 to hotfix table

This post has been updated on 29th April 2022, updates include: 

• Table updated with a new list of A22 hotfixes. 
• Pega Cloud® environments running the relevant Pega versions will have the latest A22 hotfix proactively installed by Pega.  Please refer to your Client Advisory [CAD-] cases in My Support Portal for more details

This post has been updated on 14th April 2022, updates include: 

• Rescore the vulnerability from high to medium on the CVSS scale 
• A22 hotfixes are no longer being proactively applied to Pega Cloud® environments