This vulnerability (CVE-2026-1078) in Pega Robot Studio arises from improper access control (CWE-284) in the Pega Browser Extension component. When a Robot Runtime user navigates to a crafted malicious website, the attacker may trigger arbitrary file writes on the affected system. The issue impacts Pega Robotic Automation versions 22.1 and R25 when used with Chrome or Edge browsers. The CVSS 4.0 base score is 7.2, reflecting network attack vector, low attack complexity, required user interaction, and high impact on integrity and availability. No vendor-provided patch or official remediation level is currently available.

Successful exploitation allows an attacker to write arbitrary files on the victim system running Pega Robot Studio automation with the browser extension. This could lead to modification or corruption of files, potentially disrupting robotic automation processes or enabling further malicious activity. The vulnerability requires user interaction (visiting a malicious website) and does not require privileges, increasing exposure risk. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when navigating to untrusted websites during robotic automation sessions involving Pega Robot Studio and the Pega Browser Extension. Monitoring vendor communications for updates is recommended.