Is CVE-2025-62180 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-62180 being exploited in the wild.

How severe is CVE-2025-62180?

Informational severity, with a CVSS score of 7.1, published 23 June 2026.

Which products and versions are affected?

Pegasystems Pega Infinity 8.3.0 through 25.1.2; Pegasystems Pega Platform 8.3.0 through 25.1.2.

Is there a fix for CVE-2025-62180?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-62180 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-62180?

Check whether you run Pegasystems Pega Infinity or Pegasystems Pega Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-62180: Pegasystems Pega Platform authorization bypass via crafted URLs

CVE-2025-62180 · Severity: info · CVSS 7.1 · Published 2026-06-23

The Pega Platform, a popular enterprise software suite for workflow automation and customer engagement, contains a security flaw in its authorization system. An authenticated user could bypass intended access controls by using specially crafted web addresses (URLs) to view sensitive data they are not authorized to see. This could lead to the unauthorized exposure of internal business information or customer records.

Technologies: Pegasystems Pega Platform. Vendors: Pegasystems.

Quick answers

Is CVE-2025-62180 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-62180 being exploited in the wild.
How severe is CVE-2025-62180?: Informational severity, with a CVSS score of 7.1, published 23 June 2026.
Which products and versions are affected?: Pegasystems Pega Infinity 8.3.0 through 25.1.2; Pegasystems Pega Platform 8.3.0 through 25.1.2.
Is there a fix for CVE-2025-62180?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-62180 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-62180?: Check whether you run Pegasystems Pega Infinity or Pegasystems Pega Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization weakness (CWE-639: Authorization Bypass Through User-Controlled Key) exists in Pega Platform versions 8.3.0 through Infinity 25.1.2. The vulnerability allows a network-based attacker with low-level authenticated privileges to access or execute functions without proper authorization by manipulating URL parameters. This can result in high confidentiality impact as attackers may retrieve data outside of their assigned permissions. The issue is addressed in Pega Infinity 25.1.3 and various hotfixes for older versions (e.g., HFIX-D554, HFIX-D589). Pega Cloud environments are being proactively patched by the vendor.

Affected products

Pegasystems Pega Platform / Pega Infinity 8.3.0 through 25.1.2

Timeline

2025-11-19: advisory: Initial remediation note published for I25 vulnerability series
2026-06-22: advisory: Updated remediation note published for H26 vulnerability series
2026-06-23: disclosed: CVE-2025-62180 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.