Pega continually works to implement security controls designed to protect client environments.  With this focus, Pega has issued patch releases/hotfixes for one High security vulnerability in Pega Platform. We would like to thank Mohammed F. Alaskar from Saudi Awwal Bank Cybersecurity Team for finding this vulnerability.

** - provided as a courtesy for the clients who reported the issue

We are not aware of any of our clients being compromised as a result of this vulnerability.

The remediation of this issue will be included as part of the product in the patch releases of the Pega Platform listed above. 

If you are a Pega Cloud® client, your Pega Cloud environments, running the relevant Pega versions listed in the table below, are being proactively remediated by Pega. Cloud Maintenance (CM) cases are being created for each of your environments and will provide the schedule of when the hotfixes will be applied.  If you are not on a version with a solution provided, please update as soon as possible.

If you are a United States Pega Cloud for Government (PCFG) client, Cloud Change (CC) cases are being created for the relevant hotfix, which will be applied by Pega.  If you are not on a version with a solution provided, please update as soon as possible.

If you are an on–premises or client managed cloud client, please review the tables below to determine which hotfixes correspond to your Pegasystems installations.  Once you have determined the appropriate hotfix IDs, you can download your hotfixes directly from My Security Hotfixes on My Pega.

Information regarding the availability of the hotfixes will be publicly posted on Pega Support Center on November 19, 2025. We request that clients not discuss this in public forums until after it’s been publicly posted. 

As always, we recommend our clients review our Security Checklist regularly. 

Hotfixes

Hotfixes are being created only for the patch releases listed above under Remediation.  We will not provide hotfixes on prior versions of the platform.   

As a best practice, you should update your Pega environment to the latest release to take advantage of the latest features, capabilities, and security and bug fixes.  See Keeping Current with Pega for details.