Skip to main content

This content has been archived and is no longer being updated.

Links may not function; however, this content may be relevant to outdated versions of the product.

Pegasystems statement concerning the Shellshock Bash vulnerability

Suggest edit Updated on January 9, 2017

Pegasystems does not believe the Shellshock security vulnerability can be exploited on any of the following:

  • Guardrail compliant applications built on PRPC
  • Guardrail compliant Pega frameworks based applications
  • Chordiant Foundation Server (CFS)


Shellshock is known to affect web applications implemented via the Common Gateway Interface (CGI) specification. Neither PRPC nor CFS are based on CGI; instead, they are implemented according to the Java Servlet API and deployed as Java Platform, Enterprise Edition (Java EE) applications. PRPC and CFS provide no built-in means for client access to the vulnerability in the underlying layer – the Bash shell.

Suggested approach

Since the vulnerability is in the Bash shell upon which PRPC or CFS may be deployed, it is incumbent upon all customers to ensure that their software infrastructure has been updated with the latest security patches.

Did you find this content helpful? YesNo

100% found this useful

Have a question? Get answers now.

Visit the Collaboration Center to ask questions, engage in discussions, share ideas, and help others.

Ready to crush complexity?

Experience the benefits of Pega Community when you log in.

We'd prefer it if you saw us at our best. is not optimized for Internet Explorer. For the optimal experience, please use:

Close Deprecation Notice
Contact us