Is CVE-2026-10754 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10754 being exploited in the wild.

How severe is CVE-2026-10754?

Informational severity, with a CVSS score of 7.6, published 10 August 2026.

Which products and versions are affected?

Pegasystems Pega Platform 8.5.0 through 25.1.2.

Is there a fix for CVE-2026-10754?

A patch was published on 2026-06-23: 25.1.3 Patch Release available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10754 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-10754?

Check whether you run Pegasystems Pega Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10754: Pegasystems Pega Platform cryptographic signature validation bypass

CVE-2026-10754 · Severity: info · CVSS 7.6 · Published 2026-08-10

Pega Platform, a widely-used enterprise application development and case management system, contains a flaw in its Session API that improperly validates cryptographic signatures. An attacker can forge or tamper with API requests to bypass security controls, potentially gaining unauthorized access to sensitive data or performing unauthorized actions within customer environments.

Technologies: Pegasystems Pega Platform. Vendors: Pegasystems.

Quick answers

Is CVE-2026-10754 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10754 being exploited in the wild.
How severe is CVE-2026-10754?: Informational severity, with a CVSS score of 7.6, published 10 August 2026.
Which products and versions are affected?: Pegasystems Pega Platform 8.5.0 through 25.1.2.
Is there a fix for CVE-2026-10754?: A patch was published on 2026-06-23: 25.1.3 Patch Release available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10754 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-10754?: Check whether you run Pegasystems Pega Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Pega Platform's Session API, where cryptographic signatures used to authenticate API requests are not properly validated. Insufficient checks fail to confirm that requests have been correctly signed and have not been altered in transit. The flaw affects versions from 8.5.0 through 25.1.2 and is exploitable over the network without authentication or user interaction. An attacker can forge or modify Session API requests to bypass security controls, potentially reading sensitive data or executing unauthorized actions. Patches are available: Platform releases 24.2.5, 25.1.3, and 26.1, or hotfixes for earlier versions (HFIX-D1442 through HFIX-D1443).

Affected products

Pegasystems Pega Platform 8.5.0 through 25.1.2

Timeline

2026-08-10: disclosed: Security advisory published; patches released starting June 2026
2026-06-23: patched: 25.1.3 Patch Release available
2026-06-25: patched: 24.2.5 Patch Release available
2026-07-14: patched: 26.1 Patch Release available

References

https://support.pega.com/support-doc/pega-security-advisory-m26-vulnerability-remediation-note

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.