CVE-2026-1562 is a stored Cross-site Scripting (CWE-79) vulnerability affecting Pega Infinity version 8.1.0. The flaw exists in a user interface component where input is not properly neutralized during web page generation. Exploitation requires a high privileged user with a developer role, which limits the attack surface. The CVSS 4.0 base score is 4.6 (medium severity), reflecting network attack vector, low complexity, no privileges required for attack initiation but high privileges required for the vulnerable action, and limited impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

An attacker with high privileges and a developer role could exploit this stored XSS vulnerability to inject malicious scripts into the user interface, potentially affecting users who view the compromised interface. The impact is limited due to the requirement for high privileges and the low confidentiality, integrity, and availability impact metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privileged developer role access to trusted personnel only and monitor for suspicious activity related to user interface components.