CVE-2025-59683
Published: 25 December 2025
Description
Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens. This allows a remote attacker to read potentially sensitive data and excessively consume resources,…
more
leading to a denial of service.
Mitigating Controls (NIST 800-53 r5)AI
AC-3 directly enforces approved authorizations for access to system resources, addressing the core improper access control flaw that allows unauthorized remote reading of sensitive data.
SI-2 requires timely identification, reporting, and correction of system flaws like this CVE, with the vendor recommending upgrade to version 38.1 or later to fix the vulnerability.
SC-5 protects against denial-of-service events by limiting effects of resource exhaustion caused by the attacker's excessive consumption in this vulnerability.
Security SummaryAI
CVE-2025-59683 is an Improper Access Control vulnerability (CWE-863) in the Secure Scheduler for Exchange service of Pexip Infinity versions 15.0 through 38.0 before 38.1. This issue arises specifically when the service is used with Office 365 Legacy Exchange Tokens. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H), indicating high severity due to its network accessibility and impact potential.
A remote attacker requires no privileges or user interaction to exploit this vulnerability over the network with low attack complexity. Successful exploitation enables the attacker to read potentially sensitive data while also excessively consuming resources on the affected system, resulting in a denial-of-service condition.
The Pexip security bulletin at https://docs.pexip.com/admin/security_bulletins.htm details mitigation steps, including upgrading to Pexip Infinity version 38.1 or later to address the improper access control.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an improper access control in a network-accessible service (AV:N/PR:N), enabling exploitation of a public-facing application (T1190) for unauthorized data access and resource exhaustion leading to endpoint DoS via application exploitation (T1499.004).