CVE-2026-1078
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users running automations with Google Chrome or Microsoft Edge. A malicious website could exploit this if a Robot Runtime user navigates to it.
Risk Assessment
An attacker could write arbitrary files on the user's system, potentially leading to system integrity compromise and potential code execution.
Recommendation
Update Pega Browser Extension to the latest version and avoid visiting untrusted websites while running automations.
Other vulnerabilities in Pega Browser Extension
See all- CVE-2026-0898Critical
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers automating Google Chrome and Microsoft Edge in versions 22.1 or R25. It does not affect Robot Runtime users. An attacker could create a malicious website, and the vulnerability may be exploited if a developer is tricked into visiting it during interrogation mode in Robot Studio.
- CVE-2026-1079Medium
A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed PBE. A malicious website could contain code targeting PBE and present an unexpected message box if a user navigates to it.
Original NVD description (English source)
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. A bad actor could create a website that includes malicious code. The vulnerability could occur if a Robot Runtime user navigates to the malicious website.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS