pega synchronization engine vulnerabilities

Latest pega synchronization engine CVEs

Newest publication first

1. CVE-2023-28093 A user with a compromised configuration can start an unsigned binary as a service.

   Published 2023-04-10

   Medium·CVSS 6.5 EPSS 1.4%

   A user with a compromised configuration can start an unsigned binary as a service.

2. CVE-2023-26467 A man in the middle can redirect traffic to a malicious server in a compromised configuration.

   Published 2023-04-10

   Medium·CVSS 5.4 EPSS 0.59%

   A man in the middle can redirect traffic to a malicious server in a compromised configuration.

3. CVE-2023-26466 A user with non-Admin access can change a configuration file on the client to modify the Server URL.

   Published 2023-04-10

   High·CVSS 7.8 EPSS 0.17%

   A user with non-Admin access can change a configuration file on the client to modify the Server URL.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.