CVE-2026-13761

Pega Platform versions 7.1.0 through 25.1.2 fail to properly validate inputs that are used as loop conditions, allowing crafted input to drive excessive or effectively unbounded looping. The flaw is reachable over the network without authentication or user interaction, per the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N). A successful attacker can consume processing resources and cause a denial of service, and the vector's high integrity impact suggests the vendor's 'other consequences' may extend beyond pure availability, though confidentiality is not impacted. Any organization running Pega Platform within the affected version range is exposed, whether deployed on-premises, in private cloud, or as the back end for internet-facing applications. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS assigns only a 0.3% probability of exploitation in the next 30 days, so exploitation has not yet been observed.

What to do: Inventory all Pega Platform deployments and check their versions against the affected range of 7.1.0 through 25.1.2, then upgrade to a release later than 25.1.2 as specified in Pega's security bulletin (confirm the exact fixed version with the vendor advisory, as it is not stated in this data). Until patching, restrict network access to Pega servers, particularly any internet-facing instances, and monitor for abnormal CPU consumption or hung processes. Watch Pega's advisories and the CISA KEV catalog, since the unauthenticated network vector could make this attractive once exploitation details emerge.