CVE-2026-1079— A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension.
Quick assessment
Affected
Pegasystems Pega Browser Extension (PBE)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Pegasystems Pega Robotic Automation是美国Pegasystems公司的一款机器人流程自动化软件。 Pegasystems Pega Robotic Automation存在安全漏洞，该漏洞源于Pega Browser Extension的本机消息传递主机存在漏洞，当用户导航到包含恶意代码的网站时，可能导致攻击者显示意外消息框。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-1079
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension.
Source: CVE Program / CVE List V5
Vulnerability Description
A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension. A bad actor could create a website that contains malicious code that targets PBE. The vulnerability could occur if a user navigates to this website. The malicious website could then present an unexpected message box.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Pegasystems Pega Robotic Automation 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Pegasystems Pega Robotic Automation是美国Pegasystems公司的一款机器人流程自动化软件。 Pegasystems Pega Robotic Automation存在安全漏洞，该漏洞源于Pega Browser Extension的本机消息传递主机存在漏洞，当用户导航到包含恶意代码的网站时，可能导致攻击者显示意外消息框。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Pegasystems | Pega Browser Extension (PBE) | 0 ~ 3.1.45 | - |
|
II. Public POCs for CVE-2026-1079
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-1079
请登录查看更多情报信息。
Other References for CVE-2026-1079 (1)
IV. Related Vulnerabilities
Same vendor: Pegasystems
-
CVE-2026-13761
Pega Platform versions 7.1.0 through 25.1.2 are affected by -
CVE-2026-10754
Pega Platform versions 8.5.0 through 25.1.2 are affected by -
CVE-2026-14337
Pega Platform versions 23.1.0 through 25.1.3 are affected by -
CVE-2026-1563
Pega Platform versions 8.1.0 through 25.1.2 are affected by -
CVE-2026-1562
Pega Platform versions 8.1.0 through 25.1.2 are affected by
Same weakness: CWE-284
-
CVE-2026-76281
Improper Access Control in Splunk Enterprise -
CVE-2026-76265
Improper Access Control through REST API Endpoints in Splunk -
CVE-2026-76463
Cisco Meraki Security Hardening Release: October 2026 - Impr -
CVE-2026-76498
Cisco Application Policy Infrastructure Controller Hardening -
CVE-2026-76455
Cisco NX-OS Software Security Hardening Release: October 202
V. Comments for CVE-2026-1079
No comments yet