CVE-2026-1711 is a stored cross-site scripting vulnerability (CWE-79) affecting Pegasystems Pega Infinity versions 8.1.0 through 25.1.1. The flaw arises from improper neutralization of input during web page generation in a user interface component, allowing a high privileged user with developer role permissions to inject malicious scripts. The vulnerability has a CVSS 4.8 score, indicating medium severity, with network attack vector, low complexity, and requires high privileges and partial user interaction. No official remediation or patch is currently documented, and no known exploits have been reported.

Successful exploitation could allow a high privileged developer user to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, data theft, or other client-side impacts. However, the requirement for high privileges and developer role limits the attack surface. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict developer role assignments to trusted personnel only and monitor for suspicious activity related to user interface components. No official patch or workaround has been published by Pegasystems at this time.