CVE-2025-9559

published 2025-10-16

CVE-2025-9559: Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to…

Priority P3 39 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
pega	pega_platform	24.1.0 – 24.1.3	—
pega	pega_platform	24.2.0 – 24.2.2	—
pega	pega_platform	>= 7.1.0 < 23.1.5	23.1.5
pegasystems	pega_infinity	>= 8.7.5 < Infinity 24.2.3	Infinity 24.2.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-639