Executive Summary - Action Required
Pega regularly implements security controls designed to safeguard client environments. As part of these efforts, Pega will release patch updates and hotfixes addressing five (5) Log4j security vulnerabilities in Pega Platform.
No client compromises have been reported to date; however, remediation should be implemented urgently to maintain security.
|
Advisory |
Description |
Patch Remediation |
Hotfix Remediation |
|
Log4j - CVE-2026-34480(H) CVE-2026-34479(H) CVE-2026-34478(H) CVE-2026-34477(M) CVE-2025-68161(M) |
Log4j reported vulnerabilities |
24.1.5 Patch Release (Available) 24.2.5 Patch Release (Available) 25.1.3 Patch Release (Available) 26.1.0 Release (Available) |
HFIX-D2323 - 23.1.5 HFIX-D1063 - 24.1.4
|
Dates for upcoming patch releases can be found here: Pega Infinity Patch Calendar.
Information regarding the availability of the patch releases will be publicly posted on Pega Support Center October 12, 2026. We request that clients not discuss this in public forums until after this issue has been publicly posted to enable all customers to have adequate time to apply the necessary patches and/or hotfixes.
Impact
The Apache Log4j version update remediations address the risk of the multiple Log4j issues and enhance overall system security.
Issue Details
|
Issue Details |
Apache Log4j vulnerabilities |
|
Software/Product |
Pega Platform |
|
Affected Version(s) |
From 7.X to 25.1.2 |
|
CVE |
CVE-2026-34480(H) CVE-2026-34479(H) CVE-2026-34478(H) CVE-2026-34477(M) CVE-2025-68161(M) |
|
CVSS Rating |
High (H) - 7.5, Medium (M) 5.9 & 4.8 |
|
Description |
Apache Log4j vulnerabilities |
As a best practice, you should update your Pega environment to the latest release to take advantage of the latest features, capabilities, security, and bug fixes. See Keeping Current with Pega for details.
Obtaining your Hotfixes
Hotfixes are being created only for the patch releases listed above, under Hotfix Remediation. A restart is needed after hotfix installation.
We will not provide hotfixes on prior versions of Pega Platform.
- Pega Cloud® and United States Pega Cloud for Government (PCFG) clients, using the versions listed above, will have hotfixes applied proactively, with Cloud Maintenance (CM) cases detailing the schedule.
- On-premises or client-managed cloud clients should check the table above for applicable hotfixes and download them directly from My Security Hotfixes on My Pega.
If you have questions or concerns, please raise a Support Ticket in My Support Portal.