This vulnerability (CVE-2026-1078) is classified as CWE-284 (Improper Access Control) and affects Pega Robotic Automation versions 22.1 and R25 when automations interact with Chrome or Edge browsers via the Pega Browser Extension. The flaw allows an attacker to perform arbitrary file writes if a Robot Runtime user visits a malicious website, potentially compromising system integrity. The CVSS 4.0 base score is 7.2, indicating high severity with network attack vector, low attack complexity, no privileges required, but user interaction needed. The vendor has not provided a patch or official remediation level, and no known exploits have been reported.

Successful exploitation could allow an attacker to write arbitrary files on the affected system, leading to potential unauthorized modification or corruption of data. This could undermine system integrity and possibly facilitate further attacks. The vulnerability requires user interaction (visiting a malicious website) and targets users running affected Pega Robot Studio versions with Chrome or Edge. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when navigating to untrusted websites while running affected versions of Pega Robot Studio automations with Chrome or Edge. Monitor Pegasystems' advisories for updates on patches or mitigations.