Summary
CVE-2026-13761 is a high-severity vulnerability in Pegasystems’ Pega Platform (Pega Infinity) caused by improper validation of inputs used in loop conditions (CWE-606: Unchecked Input for Loop Condition). An unauthenticated, network-based attacker can trigger excessive looping, leading to denial of service and integrity compromise on affected instances. The issue carries a CVSS base score of 8.8 and affects versions 7.1.0 through 25.1.2.
Technical details
- Root cause: The application fails to properly validate attacker-controllable input that governs a loop’s termination condition, classified under CWE-606 (Unchecked Input for Loop Condition) / CAPEC-130 (Excessive Allocation).
- Trigger conditions: An attacker supplies crafted input that is used to control loop iteration, causing excessive/uncontrolled looping within the platform.
- Attack vector: Network-based; no authentication and no user interaction is required to exploit.
- Impact: High impact to availability (denial of service via resource exhaustion from excessive looping) and high impact to integrity.
Affected software
- Pegasystems Pega Platform (Pega Infinity), versions 7.1.0 through 25.1.2
- Fixed in version 25.1.3
Severity
- CVSS v4.0 Base Score: 8.8 (High)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:L - Network attack vector, low attack complexity, no privileges or user interaction required, high integrity and availability impact.
Mitigation and recommended actions
- Immediate: Upgrade Pega Platform (Pega Infinity) to version 25.1.3 or later, as specified in Pegasystems’ security advisory.
- If immediate patching is not possible: Restrict network exposure of Pega Platform instances to trusted networks, and consult Pegasystems’ official security advisory portal for any interim guidance or configuration-based mitigations specific to your deployed version.

