# CVE-2025-62184: Pegasystems Pega Platform stored XSS in Prediction Studio

Source: https://junglewise.ai/threats/cve-2025-62184-pegasystems-pega-platform-stored-xss-in-prediction-studio  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2025-62184 · Severity: low · CVSS 3.4 · Published 2026-03-31

A security vulnerability exists in the Pega Platform, a suite used for business process management and customer engagement. An administrative user with extensive access rights could inject malicious scripts into the user interface, specifically within the Prediction Studio component. While the risk is categorized as low to medium because it requires high-level permissions to execute, it could potentially allow an attacker to view sensitive information within the user's session.

Technologies: [Pegasystems Pega Platform](https://junglewise.ai/threats/technologies/pega-platform). Vendors: [Pegasystems](https://junglewise.ai/threats/vendors/pegasystems).

## Quick answers

**Is CVE-2025-62184 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-62184 being exploited in the wild.

**How severe is CVE-2025-62184?** Low severity, with a CVSS score of 3.4, published 31 March 2026.

**Which products and versions are affected?** Pegasystems Pega Infinity 8.1.0 through 25.1.0; Pegasystems Pega Platform 8.1.0 through 25.1.0.

**Is there a fix for CVE-2025-62184?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-62184 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-62184?** Check whether you run Pegasystems Pega Infinity or Pegasystems Pega Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability (CWE-79) exists in Pega Platform versions 8.1.0 through 25.1.0. The flaw is located within a user interface component, specifically affecting users with Pega Prediction Studio access. An attacker requires administrative privileges and extensive access rights to successfully inject malicious scripts. If exploited, the vulnerability allows for the execution of arbitrary JavaScript in the context of a victim's browser session, though the impact is limited to low confidentiality loss with no impact on integrity or availability. Remediation is available in Pega Platform patches 24.1.4, 24.2.4, and version 25.1.1.

## Affected products

- Pegasystems Pega Platform 8.1.0 through 25.1.0
- Pegasystems Pega Infinity 8.1.0 through 25.1.0

## Timeline

- 2026-03-16: advisory: Vendor advisory O25 published by Pegasystems
- 2026-03-31: disclosed: CVE-2025-62184 published to NVD

## References

- [https://support.pega.com/support-doc/pega-security-advisory-o25-vulnerability-remediation-note](https://support.pega.com/support-doc/pega-security-advisory-o25-vulnerability-remediation-note)

## Related threats

- [Pegasystems Pega Platform improper validation of loop condition inputs](https://junglewise.ai/threats/cve-2026-13761-pegasystems-pega-platform-improper-validation-of-loop-condition)
- [Pegasystems Pega Platform cryptographic signature validation bypass](https://junglewise.ai/threats/cve-2026-10754-pegasystems-pega-platform-cryptographic-signature-validation)
- [Pegasystems Pega Platform reflected XSS in Dev Studio](https://junglewise.ai/threats/cve-2026-1563-pegasystems-pega-platform-reflected-xss-in-dev-studio)
- [Pegasystems Pega Platform stored XSS in Dev Studio](https://junglewise.ai/threats/cve-2026-1562-pegasystems-pega-platform-stored-xss-in-dev-studio)
- [Pegasystems Pega Platform authorization bypass via crafted URLs](https://junglewise.ai/threats/cve-2025-62180-pegasystems-pega-platform-authorization-bypass-via-crafted-urls)