Log in Start free

Vulnerability · Published Apr 7, 2026 · Assigned by Pega

CVE-2026-1079A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension.

Medium 6.0

In plain English

A medium-severity improper access control in Pega Browser Extension (PBE) from Pegasystems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 4.0)6.0Medium
Exploit odds (30 days)0.3%top 80.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension. A bad actor could create a website that contains malicious code that targets PBE. The vulnerability could occur if a user navigates to this website. The malicious website could then present an unexpected message box.

Affected products (as reported)

VendorProductVersions
Pegasystems Pega Browser Extension (PBE) 0 – before 3.1.45

Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

References