Infinity
Monthly
Unauthenticated remote code execution in Pexip Infinity Conferencing Nodes (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) allows an attacker who can reach the node over the network to run arbitrary code as an unprivileged service account by sending crafted input that triggers an out-of-bounds write. Affected builds are all versions before 38.2 as well as 39.0, 39.1 and 40.0; a fixed 38.2 release and corresponding maintenance releases are referenced in Pexip's security bulletins. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), but exploitation requires no authentication, no user interaction and no special conditions, and the resulting code execution is unprivileged - full host takeover would require chaining a separate local privilege-escalation bug such as sibling CVE-2026-103106.
Improper input validation in Pexip Infinity's media implementation allows an unauthenticated remote party to send a crafted media stream that causes memory corruption or a controlled software abort on the conferencing node, resulting in denial of service. Affected releases are Infinity before 38.2 and the 39.0, 39.1, and 40.0 branches; because the published vector is network-reachable with no privileges (PR:N) and no user interaction (UI:N), any host able to route media to an exposed node can attempt exploitation, though CISA's SSVC assessment rates the issue as not automatable, indicating a hand-crafted rather than commodity attack. The confirmed outcome is a controlled abort (availability impact), with memory corruption explicitly a stated potential rather than demonstrated, and the published 9.4 score is moderated in independent assessment (C:N/I:L/A:H) since confidentiality impact is not established; there is no public exploit identified at time of analysis and EPSS is low at 0.24% (14th percentile).
Remote, unauthenticated denial of service in Pexip Infinity (all releases before 38.2, plus 39.0, 39.1, and 40.0) lets an attacker who can reach a node's media service send crafted input that triggers a software abort and crashes the affected process. The vulnerability carries a CVSS 3.1 base score of 7.5 (High), driven entirely by availability impact (A:H) with no confidentiality or integrity loss, and requires only network reachability to the media-plane service - no credentials, no user interaction, and no non-default configuration. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical risk is concentrated in internet-facing or broadly reachable Conferencing Nodes, while nodes segmented behind firewalls or restricted to trusted media peers face reduced exposure.
Local privilege escalation to root in Pexip Infinity (versions before 38.2, plus 39.0, 39.1, and 40.0) allows an attacker who already holds a foothold on a node to break out of a low-privileged local context and obtain full root control. Per the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the flaw is local-only, requires low privileges, and is not remotely exploitable on its own: the attacker must first run arbitrary code on the node, either by chaining a separate remote code execution vulnerability or by already possessing administrative access to the node's operating system. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); the practical risk is that this bug turns any successful initial compromise of a Pexip Infinity host into a complete root compromise, so it should be treated as a meaningful post-exploitation escalation rather than a standalone remote threat.
Improper access control in Pexip Infinity's product-internal, inter-node API lets an attacker who already holds a foothold on one node of a multi-node deployment execute arbitrary code as an unprivileged user on another node. The affected builds are Infinity before 38.2 as well as 39.0, 39.1 and 40.0, tracked as CPE cpe:2.3:a:pexip:infinity:*:*:*:*:*:*:*:* and rooted in CWE-863 (incorrect authorization). The internal API requires no authentication (PR:N) and no user interaction (UI:N), but the attack path is adjacent-network only (AV:A) and code runs unprivileged on the target rather than as root; there is no public exploit identified at time of analysis and no CISA KEV listing, though the 8.8 CVSS and lateral-movement potential make this a high-priority fix for any clustered installation.
Unauthenticated remote attackers can abort the media process in Pexip Infinity, causing a denial of service on conferencing nodes that are reachable from an untrusted network. The root cause is improper input validation in the media implementation (CWE-617, a reachable assertion/software abort): crafted media input drives the software into an unrecoverable abort rather than failing gracefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms this is availability-only - no confidentiality or integrity impact and no code execution - and affected releases are Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0. No public exploit code and no confirmed active exploitation were identified at time of analysis; the practical exposure driver is whether media-processing interfaces are directly reachable, since deployments that restrict media to trusted networks or front it with session border controls materially reduce reachability.
Malformed signaling input delivered to Pexip Infinity deployments running versions before 41.0 can abort the signaling software, denying conferencing service to users of the affected node. The issue is network-reachable and carries a CVSS 3.1 base of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), with the severity driven almost entirely by the high availability impact plus the scope-change component rather than by any loss of confidentiality or integrity. The CVSS vector's PR:N indicates no privilege requirement, but exploitation still carries an access precondition: the attacker must be able to reach the WebRTC/API signaling entry point and participate in a gateway call, so internet-facing nodes that permit open WebRTC/API gateway calling are directly at risk while internal-only or call-restricted deployments are substantially less exposed. There is no public exploit identified at time of analysis, and the fixed release (Pexip Infinity 41.0) is available.
Denial of service in Pexip Infinity 30.0 through 40.x allows unauthenticated remote attackers to render a node inaccessible by sending input that the web server fails to validate properly (CWE-770). The flaw is network-reachable and low-complexity with no authentication (PR:N) or user interaction (UI:N) required, and its sole impact is availability - there is no confidentiality or integrity loss - with CVSS 3.1 scored 8.6. No public exploit code and no confirmed active exploitation were identified at time of analysis; risk is concentrated in deployments whose management or conferencing web interface is exposed to untrusted networks.
Unauthenticated remote attackers can cause a denial of service against Pexip Infinity conferencing deployments by sending malformed signaling messages that trigger a software abort. The vulnerability, tracked as CVE-2026-103100, affects all versions before 40.1 and stems from improper input validation (CWE-617). No public exploit identified at time of analysis, but the flaw is remotely reachable with low complexity and high availability impact, making prompt patching critical for internet-exposed signaling interfaces.
Malformed media-plane input to Pexip Infinity before 41.1 can trigger an assertion failure and abort the media process, causing a denial of service. The flaw is remotely reachable without authentication or user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, availability-only impact), though practical exposure depends on whether the media services are reachable from untrusted networks. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Navarino Infinity is prone to session fixation attacks. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated remote code execution in Pexip Infinity Conferencing Nodes (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) allows an attacker who can reach the node over the network to run arbitrary code as an unprivileged service account by sending crafted input that triggers an out-of-bounds write. Affected builds are all versions before 38.2 as well as 39.0, 39.1 and 40.0; a fixed 38.2 release and corresponding maintenance releases are referenced in Pexip's security bulletins. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), but exploitation requires no authentication, no user interaction and no special conditions, and the resulting code execution is unprivileged - full host takeover would require chaining a separate local privilege-escalation bug such as sibling CVE-2026-103106.
Improper input validation in Pexip Infinity's media implementation allows an unauthenticated remote party to send a crafted media stream that causes memory corruption or a controlled software abort on the conferencing node, resulting in denial of service. Affected releases are Infinity before 38.2 and the 39.0, 39.1, and 40.0 branches; because the published vector is network-reachable with no privileges (PR:N) and no user interaction (UI:N), any host able to route media to an exposed node can attempt exploitation, though CISA's SSVC assessment rates the issue as not automatable, indicating a hand-crafted rather than commodity attack. The confirmed outcome is a controlled abort (availability impact), with memory corruption explicitly a stated potential rather than demonstrated, and the published 9.4 score is moderated in independent assessment (C:N/I:L/A:H) since confidentiality impact is not established; there is no public exploit identified at time of analysis and EPSS is low at 0.24% (14th percentile).
Remote, unauthenticated denial of service in Pexip Infinity (all releases before 38.2, plus 39.0, 39.1, and 40.0) lets an attacker who can reach a node's media service send crafted input that triggers a software abort and crashes the affected process. The vulnerability carries a CVSS 3.1 base score of 7.5 (High), driven entirely by availability impact (A:H) with no confidentiality or integrity loss, and requires only network reachability to the media-plane service - no credentials, no user interaction, and no non-default configuration. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical risk is concentrated in internet-facing or broadly reachable Conferencing Nodes, while nodes segmented behind firewalls or restricted to trusted media peers face reduced exposure.
Local privilege escalation to root in Pexip Infinity (versions before 38.2, plus 39.0, 39.1, and 40.0) allows an attacker who already holds a foothold on a node to break out of a low-privileged local context and obtain full root control. Per the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the flaw is local-only, requires low privileges, and is not remotely exploitable on its own: the attacker must first run arbitrary code on the node, either by chaining a separate remote code execution vulnerability or by already possessing administrative access to the node's operating system. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); the practical risk is that this bug turns any successful initial compromise of a Pexip Infinity host into a complete root compromise, so it should be treated as a meaningful post-exploitation escalation rather than a standalone remote threat.
Improper access control in Pexip Infinity's product-internal, inter-node API lets an attacker who already holds a foothold on one node of a multi-node deployment execute arbitrary code as an unprivileged user on another node. The affected builds are Infinity before 38.2 as well as 39.0, 39.1 and 40.0, tracked as CPE cpe:2.3:a:pexip:infinity:*:*:*:*:*:*:*:* and rooted in CWE-863 (incorrect authorization). The internal API requires no authentication (PR:N) and no user interaction (UI:N), but the attack path is adjacent-network only (AV:A) and code runs unprivileged on the target rather than as root; there is no public exploit identified at time of analysis and no CISA KEV listing, though the 8.8 CVSS and lateral-movement potential make this a high-priority fix for any clustered installation.
Unauthenticated remote attackers can abort the media process in Pexip Infinity, causing a denial of service on conferencing nodes that are reachable from an untrusted network. The root cause is improper input validation in the media implementation (CWE-617, a reachable assertion/software abort): crafted media input drives the software into an unrecoverable abort rather than failing gracefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms this is availability-only - no confidentiality or integrity impact and no code execution - and affected releases are Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0. No public exploit code and no confirmed active exploitation were identified at time of analysis; the practical exposure driver is whether media-processing interfaces are directly reachable, since deployments that restrict media to trusted networks or front it with session border controls materially reduce reachability.
Malformed signaling input delivered to Pexip Infinity deployments running versions before 41.0 can abort the signaling software, denying conferencing service to users of the affected node. The issue is network-reachable and carries a CVSS 3.1 base of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), with the severity driven almost entirely by the high availability impact plus the scope-change component rather than by any loss of confidentiality or integrity. The CVSS vector's PR:N indicates no privilege requirement, but exploitation still carries an access precondition: the attacker must be able to reach the WebRTC/API signaling entry point and participate in a gateway call, so internet-facing nodes that permit open WebRTC/API gateway calling are directly at risk while internal-only or call-restricted deployments are substantially less exposed. There is no public exploit identified at time of analysis, and the fixed release (Pexip Infinity 41.0) is available.
Denial of service in Pexip Infinity 30.0 through 40.x allows unauthenticated remote attackers to render a node inaccessible by sending input that the web server fails to validate properly (CWE-770). The flaw is network-reachable and low-complexity with no authentication (PR:N) or user interaction (UI:N) required, and its sole impact is availability - there is no confidentiality or integrity loss - with CVSS 3.1 scored 8.6. No public exploit code and no confirmed active exploitation were identified at time of analysis; risk is concentrated in deployments whose management or conferencing web interface is exposed to untrusted networks.
Unauthenticated remote attackers can cause a denial of service against Pexip Infinity conferencing deployments by sending malformed signaling messages that trigger a software abort. The vulnerability, tracked as CVE-2026-103100, affects all versions before 40.1 and stems from improper input validation (CWE-617). No public exploit identified at time of analysis, but the flaw is remotely reachable with low complexity and high availability impact, making prompt patching critical for internet-exposed signaling interfaces.
Malformed media-plane input to Pexip Infinity before 41.1 can trigger an assertion failure and abort the media process, causing a denial of service. The flaw is remotely reachable without authentication or user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, availability-only impact), though practical exposure depends on whether the media services are reachable from untrusted networks. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Navarino Infinity is prone to session fixation attacks. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.