CVE-2022-24082 is a critical deserialization vulnerability (CVSS 9.8) affecting on-premise Pega Platform (pega infinity) installations where the JMX interface is internet-exposed without proper filtering. This flaw allows unauthenticated attackers to upload serialized payloads via the network with low complexity, leading to complete compromise of the underlying system, though PegaCloud deployments are not affected. The vulnerability is listed on a "Hot List: Active" and has public exploit code available, including an ExploitDB entry for Remote Code Execution (RCE). Its high EPSS score (0.45577) and active community discussion further indicate a significant probability of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.1.0, < 8.7.3CPE matchmatch criteria | cpe:2.3:a:pega:infinity:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.