CVE-2026-1078

High

Published: 07/04/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users running automations with Google Chrome or Microsoft Edge. A malicious website could exploit this if a Robot Runtime user navigates to it.

Risk Assessment

An attacker could write arbitrary files on the user's system, potentially leading to system integrity compromise and potential code execution.

Recommendation

Update Pega Browser Extension to the latest version and avoid visiting untrusted websites while running automations.

Other vulnerabilities in Pega Browser Extension

CVE-2026-0898Critical
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers automating Google Chrome and Microsoft Edge in versions 22.1 or R25. It does not affect Robot Runtime users. An attacker could create a malicious website, and the vulnerability may be exploited if a developer is tricked into visiting it during interrogation mode in Robot Studio.

Original NVD description (English source)

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. A bad actor could create a website that includes malicious code. The vulnerability could occur if a Robot Runtime user navigates to the malicious website.