CVE-2021-27651

What it actually does

Pega Infinity versions 8.2.1 through 8.5.2 contain an authentication bypass in the local-account password reset workflow. A remote, unauthenticated attacker can abuse the reset functionality to bypass local authentication checks, potentially take over local operator accounts, and gain the permissions assigned to those accounts. Because the issue is network-exploitable, low-complexity, requires no prior credentials or user interaction, and has high confidentiality, integrity, and availability impact, successful exploitation can lead to full application compromise depending on the privileges of the targeted account.

Why it matters to the business

An exposed vulnerable Pega Infinity deployment could allow an attacker to gain unauthorized access to business applications and the data and workflows they manage. This may result in data theft, fraudulent transactions or workflow manipulation, service disruption, regulatory exposure, and loss of trust. The vulnerability is weaponized and has a high EPSS score, so organizations running affected versions should treat internet-facing instances and systems handling sensitive business processes as urgent remediation priorities, even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies a reachable Pega Infinity instance running an affected version. They interact with the local-account password reset functionality and craft the reset flow in a way that bypasses the intended authentication checks. If successful, the attacker can reset or assume access to a local operator account without knowing the original password. After logging in, they inherit that account’s application roles and privileges, which may allow them to view sensitive records, modify cases and workflows, create additional access paths, alter configuration, or disrupt application operations. If the compromised account has administrative privileges, the attacker may establish persistence, expand access, and use the Pega application as a platform for broader business process abuse.

How to fix it

Upgrade Pega Infinity to a vendor-supported release that contains the fix for this authentication bypass. The affected range is Pega Infinity 8.2.1 through 8.5.2; deployments in that range should not remain exposed. If an immediate full upgrade is not possible, contact Pegasystems for the applicable hotfix or maintenance update for the deployed release line, and prioritize applying it to internet-facing and high-sensitivity environments. As compensating controls until patched, restrict access to Pega login and password reset endpoints using network controls or identity-aware access proxies, disable or tightly control local-account password reset where operationally feasible, require SSO/MFA for interactive access, review and reduce privileged local operator accounts, and monitor for unexpected password reset and login activity.

How to confirm the fix worked

Confirm the running Pega Infinity version is outside the affected range or that the applicable vendor hotfix has been applied. Validate from administrative version information, deployment manifests, release notes, and package inventories rather than relying only on external banners. Test that unauthenticated users cannot complete local-account password reset flows without the expected verification steps. Review configuration to ensure local password reset is disabled or restricted if not needed, and confirm that administrative and high-privilege local accounts have not had recent unexplained password changes. For internet-facing systems, perform an external exposure check to verify that only intended Pega endpoints are reachable and that access controls protecting login and reset functionality are effective.

Typical attack path

1. Discover an exposed Pega Infinity application, commonly through internet scanning, known application URLs, or login portals.
2. Confirm the application appears to be running an affected Pega Infinity version or exposes the vulnerable local password reset workflow.
3. Submit a password reset request for a local operator account and abuse the flawed reset logic to bypass normal authentication checks.
4. Set or obtain usable credentials for the targeted local account.
5. Log in to the Pega application as the compromised account.
6. Enumerate roles, privileges, cases, data objects, integrations, and administrative functions available to the account.
7. Use the obtained access to exfiltrate data, manipulate workflows, create persistence, or disrupt application operations.

How to detect it

To determine whether exploitation has already occurred, review Pega application logs, web server or reverse proxy access logs, identity and SSO logs, application audit logs, and operator account change history for suspicious password reset activity. Focus on unauthenticated password reset requests followed closely by successful logins, password resets for privileged or dormant local accounts, resets initiated from unfamiliar IP addresses, repeated reset attempts against multiple operators, and changes to roles, access groups, authentication settings, or administrator accounts after a reset. Correlate timestamps across web access logs and Pega audit records to identify reset-to-login sequences from the same source IP or user agent. Investigate any new or modified local operator accounts, unexpected administrative actions, export/download activity, changes to rules or application configuration, and unusual case or data access after the suspected account takeover. Because the vulnerability is weaponized, absence of a KEV listing should not be treated as evidence of no exploitation.

• pyForgotPassword
• ForgotPassword
• forgot password
• password reset
• Password reset
• reset password
• Reset password
• Data-Admin-Operator-ID
• Operator ID
• /prweb/PRServlet
• /prweb

What your security team should do

• Inventory all Pega Infinity deployments and identify any running versions 8.2.1 through 8.5.2.
• Prioritize immediate remediation for internet-facing, partner-facing, and business-critical Pega applications because exploitation is weaponized and EPSS is high.
• Upgrade to a fixed vendor-supported Pega release or apply the applicable Pegasystems hotfix for the deployed release line.
• Temporarily restrict external access to local password reset functionality until remediation is complete.
• Review local operator accounts, especially administrator and service accounts, for recent password resets, lockouts, profile changes, new roles, or unexpected successful logins.
• Rotate credentials for local privileged accounts if exploitation is suspected or cannot be ruled out.
• Ensure SSO and MFA are enforced where supported, and minimize reliance on local application accounts.
• Increase logging and alerting for password reset events followed by successful logins, especially from unfamiliar IP addresses, geographies, user agents, or automation patterns.
• Perform a post-remediation compromise assessment using application logs, web access logs, identity logs, and change/audit records.