Pega continually works to implement security controls designed to protect client environments.  With this focus, Pega has issued patch releases/hotfixes for one Critical security vulnerability in Pega Platform. 

We would like to acknowledge Daniel Wiseman from Commonwealth Bank of Australia for finding this vulnerability.

We are not aware of any of our clients being compromised as a result of this vulnerability. 

Hotfixes are being provided for the clients running on Pega Platform 8.7.0 and higher.  We are also providing hotfixes for clients on 8.1.x to 8.6.x in the latest patch release only (e.g. 8.1.9, 8.2.8, 8.3.6, 8.4.6, 8.5.6, 8.6.6).   We will not provide hotfixes on versions of the platform prior to 8.x. In addition, steps are not available as part of a local change. 

We urge your organization to update as soon as possible.   

In 2022, Pega issued the  A22 Security Advisory. The D24 advisory extends the A22 advisory by addressing additional use cases and allows the java injection protection to be controlled by an admin and not just developers. 

Please refer to your Client Advisory (CAD-), sent 22nd Oct 2024,  for specific details on the behavior of the hotfix.

If you are a Pega Cloud® client, your Pega Cloud® environments running the relevant Pega versions listed in the table below, are being proactively remediated by Pega. Cloud Maintenance (CM) cases are being created for each of your environments and will provide the schedule of when the hotfixes will be applied.  If you are not on a version with a solution provided, you need to upgrade as soon as possible. 

If you are a United States Pega Cloud for Government (PCFG) client, Cloud Change (CC) cases are being created for the relevant hotfix, which will be applied by Pega.   

If you are an on–premises or client managed cloud client, please review the tables below to determine which hotfixes correspond to your Pegasystems installation.  Once you have determined the appropriate hotfix IDs, you can now download your hotfix directly from My Security Hotfixes on My Pega.  

Information regarding the availability of the hotfixes will be publicly posted on Pega Support Center on November 20th, 2024.  In order to give all Pega clients time to patch their on-premises systems, we request that clients not discuss this in public forums until after it’s been publicly posted.  

As always, we recommend our clients review our Security Checklist regularly.  

Issue Details 

Hotfixes 

A Hotfix is being created as noted above for the following releases: All Pega Platform 8.7.0 and higher along with 8.1.9, 8.2.8, 8.3.6, 8.4.6, 8.5.6, and 8.6.6.  We will not provide hotfixes on versions of the platform prior to 8.7.0 except for the six noted above. You should upgrade as soon as possible.  Steps are not available as part of a local change.     

A restart will be needed for the hotfix changes to apply. 

As a best practice, you should update your Pega environment to the latest release to take advantage of the latest features, capabilities, security and bug fixes.  See Keeping current with Pega. 

Mitigations: 

Pega strongly recommends clients running Pega Platform 6.x, 7.x, and 8.x systems to upgrade to the latest patch versions to take advantage of the latest features, capabilities, security, and bug fixes as described here: Keeping Current with Pega. 

If you have any questions or concerns, please raise a Support ticket with Global Client Support in My Support Portal for assistance.