Pexip Infinity CVE-2025-59683

Exploitable only when the Pexip Infinity Secure Scheduler for Exchange service is deployed AND configured to use Office 365 Legacy Exchange Tokens (a deprecated Microsoft Exchange authentication token type); deployments not running this integration are not affected. Within that configuration, per CVSS AV:N/AC:L/PR:N/UI:N the attack is remote, low-complexity, unauthenticated, and requires no user interaction against affected versions 15.0 through 38.0. The primary limiting factor is the non-default, legacy-token-dependent configuration; the deprecation of Legacy Exchange Tokens by Microsoft further narrows the real-world exposed population. Fixed in Pexip Infinity 38.1.

The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) frames this as a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and availability impact - nominally critical. However, the real-world risk is materially lower than the headline score because exploitation is gated by a specific deployment condition: the Secure Scheduler for Exchange service must be in use AND configured with Office 365 Legacy Exchange Tokens, a Microsoft feature that has been deprecated and progressively disabled, so many Pexip Infinity deployments will not be in the vulnerable configuration at all. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC or SSVC decision data was supplied, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active or automated exploitation. The impact is split: an access-control flaw (CWE-863) permits reading potentially sensitive scheduling/meeting data (C:H) and abuse of the endpoint to exhaust resources for denial of service (A:H), with no integrity impact (I:N). Net assessment: a genuinely serious flaw for organizations still running the affected feature with legacy tokens, but for the broader Pexip install base the effective priority is moderate rather than the 9.1 would suggest - the gating configuration is the dominant risk-limiting factor and should be verified before triage.

A remote, unauthenticated attacker identifies a Pexip Infinity deployment (15.0-38.0) running the Secure Scheduler for Exchange service integrated with Office 365 Legacy Exchange Tokens, then sends crafted requests to the improperly-access-controlled scheduler endpoint to read potentially sensitive meeting/scheduling data belonging to other users. The same endpoint can be driven with repeated requests to excessively consume backend resources, degrading or denying the scheduling service. No public exploit code has been identified at time of analysis, and success requires the target to actually be running the legacy-token integration.