Pexip develops a narrow portfolio of real-time communication and video conferencing infrastructure products, including Pexip Infinity and its associated meeting-room and proxy components, which serve as critical backbone systems for enterprise unified communications. Vulnerabilities affecting the vendor skew toward serious outcomes, with a meaningful share reaching critical severity, and tend to cluster around input-validation weaknesses, resource-exhaustion conditions, and assertion failures that are characteristic of protocol-parsing and session-management code in conferencing platforms. The exposure pattern reflects the vendor's role as a trusted intermediary in media and signaling flows, where both authenticated and unauthenticated attack surfaces create recurring opportunities for denial-of-service and bypass conditions. Defenders should prioritize patches for internet-exposed or trusted-network instances of Pexip Infinity and monitor for session-disruption anomalies; current exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Pexip over time
Signals from CVEs in this vendor scope (55 CVEs).
55 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-6551CRITICAL Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary code via vectors related to Conferencing Nodes. | May 2, 2017 | 9.8 | 33 | NO | NO |
CVE-2021-29656CRITICAL Pexip Infinity Connect before 1.8.0 mishandles TLS certificate validation. The allow list is not properly checked. | Feb 18, 2022 | 9.8 | 31 | NO | NO |
CVE-2020-11805CRITICAL Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN. | Sep 25, 2020 | 9.8 | 31 | NO | NO |
CVE-2015-4719CRITICAL The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request. | Sep 24, 2020 | 9.8 | 30 | NO | NO |
CVE-2021-29655CRITICAL Pexip Infinity Connect before 1.8.0 omits certain provisioning authenticity checks. Thus, untrusted code may execute. | Feb 18, 2022 | 9.8 | 29 | NO | NO |
CVE-2025-59683CRITICAL Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens. This allows | Dec 25, 2025 | 9.1 | 28 | NO | NO |
CVE-2025-66377HIGH Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already has access to execute code on one node wi | Dec 25, 2025 | 7.5 | 26 | NO | NO |
CVE-2022-26656HIGH Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join. | Jul 17, 2022 | 8.2 | 26 | NO | NO |
CVE-2025-48704HIGH Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a denial of service. | Dec 25, 2025 | 7.5 | 25 | NO | NO |
CVE-2025-32096HIGH Pexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that allows an attacker to trigger a software abort, resulting in a denial of service. | Dec 25, 2025 | 7.5 | 25 | NO | NO |
Signals from CVEs in this vendor scope (55 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Pexip.
Media articles that mention a CVE ID that affects a product developed by Pexip — matched by CVE ID, not by vendor name.