CVE-2026-1711 is a stored Cross-Site Scripting vulnerability affecting Pegasystems Pega Infinity platform versions 8.1.0 through 25.1.1. The flaw exists in a user interface component that improperly neutralizes input during web page generation, allowing injection of malicious scripts. Exploitation requires a user with high privileges and a developer role, limiting the attack surface. The vulnerability has a CVSS 4.8 score, indicating medium severity. No patch or official remediation level has been disclosed by the vendor as of the published date.

Successful exploitation could allow a high privileged developer user to inject and store malicious scripts in the application interface, potentially leading to script execution in the context of other users viewing the affected component. However, the requirement for high privilege reduces the likelihood of exploitation by low-privileged attackers. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict developer role assignments to trusted personnel only and monitor for suspicious activity related to user interface components. Avoid granting unnecessary high privileges to users.