Pega continually works to implement security controls designed to protect client environments.  

With this focus, Pega has issued hotfixes for a critical security vulnerability in Pega Platform.  The vulnerability was found by a client doing penetration testing on their application, and impacts versions 7.3.1 through to 8.7.2 of Pega Infinity. We would like to thank Lewis Churchill, Daniel Wiseman and Alan Tran for finding this vulnerability.

We are not aware of any of our clients being compromised as a result of this vulnerability. 

To block malicious actors from exploiting this vulnerability, Pega has created the C22 Hotfix for each relevant version to remediate this issue.  

If you are a Pega Cloud client, your Pega Cloud® environments running the relevant Pega versions, are being proactively remediated by Pega. A CM case is being created for each of your environments which provides the schedule of when the Hotfix is being applied.

If you are a Pega Cloud for Government (PCFG) client, a SR case is being created which will provide the relevant Hotfix for you to apply to your PCFG environments. A system restart, by the Pega Cloud team, will then be required for the hotfix to take effect.

If you are an on–premises client, please review the table below to determine which hotfix corresponds to your Pegasystems installation. Once you have determined the appropriate hotfix ID, please submit a hotfix request using My Support Portal.  As always, be sure you have appropriate backups in place before applying the hotfix. Note that a system restart will be required for the hotfix to take effect. 

Reissue of 7.4 hotfix [HFIX-83599] on 12^th July 2022

As part of the C22 Security Advisory, a hotfix was created for version 7.4 – HFIX-83599.  Client’s who have installed this fix already are protected for the C22 issue this fix was created for. However, some clients have run into errors related to missing dependent clauses.  Affected clients have been notified and urged to download the updated hotfix.

Hotfixes: