Pega continually works to implement security controls designed to protect client environments.  With this focus, Pega has issued patch releases/hotfixes for one high security vulnerability in Pega Platform. We would like to thank Tomasz Stachowicz for finding this vulnerability.

We are not aware of any clients being affected as a result of this issue.  Out of an abundance of caution, we are taking the extraordinary step of issuing hotfixes for all versions affected. 

The versions affected are listed below and the remediation for this issue will be provided in the 8.8.5, 23.1.1, and 24.1.0 product patch and higher releases.  Hotfixes are available for the affected versions as listed below. 

If you are a Pega Cloud client, your Pega Cloud® environments running the relevant Pega versions listed in the table below, are being proactively remediated by Pega. Cloud Maintenance [ CM ] cases are being created for each of your environments which will provide the schedule of when the hotfixes will be applied. 

If you are a United States Pega Cloud for Government (PCFG) client, Service Request [ SR ] cases are being created which will provide the relevant hotfixes for you to apply to your PCFG environments.  

If you are an on–premises or client managed cloud client, please review the tables below to determine which hotfixes correspond to your Pegasystems installation. Once you have determined the appropriate hotfix IDs, please submit hotfix requests using My Support Portal.  As always, be sure you have appropriate backups in place before applying the hotfixes.  

As always, we recommend our clients review our Security Checklist regularly.  

CVE Details: 

Hotfixes: 

Hotfixes have been created for the affected patch releases. No restart is needed after installation. 

As a best practice, you should update your Pega environment to the latest release to take advantage of the latest features, capabilities, and security and bug fixes.  See Keeping current with Pega.