CVE-2026-1563 is a reflected cross-site scripting vulnerability (CWE-79) affecting Pega Infinity version 8.1.0. The vulnerability arises from improper neutralization of input during web page generation in a user interface component. Exploitation requires a high privileged user with a developer role and user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack vector, high privileges required, partial user interaction, and low impact on confidentiality and integrity. No official remediation or patch has been published as of the data provided.

An attacker with high privileges and developer role could exploit the reflected XSS vulnerability to execute malicious scripts in the context of the affected application. The impact is limited due to the requirement for high privileges and user interaction, and the CVSS score reflects a medium severity with low confidentiality and integrity impact. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitor vendor communications for updates. Limit high privileged developer role access to trusted users and apply standard XSS mitigations where possible.