CVE-2025-59683: 
Pexip Infinity Management Node vulnerability analysis and mitigation

CVE-2025-59683 is an Improper Access Control vulnerability (CWE-863: Incorrect Authorization) in the Secure Scheduler for Exchange service of Pexip Infinity, affecting versions 15.0 through 38.0 (before 38.1) when configured with Office 365 Legacy Exchange Tokens. The flaw allows unauthenticated remote attackers to read potentially sensitive data and excessively consume resources, resulting in denial of service. It was published on December 25, 2025, with a patch available in version 38.1. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) (Red Hat CVE, Pexip Security Bulletins).

The root cause is Incorrect Authorization (CWE-863) in the Secure Scheduler for Exchange service, specifically when Office 365 Legacy Exchange Tokens are in use. The authorization logic fails to properly validate or enforce access controls on incoming requests, allowing a remote, unauthenticated attacker to bypass authentication and interact with the service over the network. The attack requires no privileges and no user interaction, and has low attack complexity, making it straightforward to exploit from any network-accessible position. No public proof-of-concept or detailed technical write-up has been identified at this time (Red Hat CVE, ENISA EUVD).

Successful exploitation allows a remote, unauthenticated attacker to read potentially sensitive data processed by the Secure Scheduler for Exchange service (high confidentiality impact) and to excessively consume server resources, causing a denial of service (high availability impact). Integrity is not directly affected. The vulnerability's network-accessible nature and lack of authentication requirements mean any internet-exposed Pexip Infinity deployment using Office 365 Legacy Exchange Tokens is at risk, potentially exposing meeting scheduling data and disrupting conferencing services (Red Hat CVE, ENISA EUVD).

There is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation at this time. No threat actor attribution has been reported. The EPSS score is approximately 0.136%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CISA referenced it in their weekly vulnerability bulletin for the week of December 22, 2025 (CISA Bulletin, Red Hat CVE).

The primary remediation is to upgrade Pexip Infinity to version 38.1 or later, which addresses the improper access control in the Secure Scheduler for Exchange service (Pexip Security Bulletins). If immediate patching is not feasible, administrators should restrict network access to the Secure Scheduler for Exchange service using firewall rules or network segmentation, and review Office 365 Legacy Exchange Token configurations. Auditing logs for unauthorized access attempts to the Exchange scheduling service is also recommended as a compensating control (Red Hat CVE).

The vulnerability received coverage from automated CVE tracking services and security news aggregators shortly after its December 25, 2025 publication, including mentions on Mastodon and Bluesky via The Hacker Wire. CISA included it in their weekly vulnerability summary bulletin for the week of December 22, 2025. No notable independent researcher commentary or significant vendor statements beyond the patch release have been identified (CISA Bulletin, Pexip Security Bulletins).