« Volver al listado

CVE-2026-103105

Estado: AnalizadaAlta (8.8)—

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-863 (improper access control) en API interna permite ejecución arbitraria de código remotamente desde nodo comprometido. AV:A requiere acceso local previo; explotación lateral (T1210). Impacto: ejecución de comandos y abuso de credenciales/acceso.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramPassword PoliciesNetwork Segmentation

Tecnologías afectadas (1)

Pexip — Pexip Infinity

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-103105",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-103105",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-02T12:52:34.392027Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "Pexip",
          "product": "Infinity",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "38.2.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "39.0.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "39.1.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "40.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-30T03:16:59.623",
  "references": [
    {
      "url": "https://docs.pexip.com/admin/security_bulletins.htm",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node."
    }
  ],
  "lastModified": "2026-10-05T20:44:01.657",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFD7712D-CD23-4418-BBDA-006D51921999",
              "versionEndExcluding": "38.2"
            },
            {
              "criteria": "cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4DD39F66-4440-45B3-9400-3297C4201ECB",
              "versionEndIncluding": "39.1",
              "versionStartIncluding": "39.0"
            },
            {
              "criteria": "cpe:2.3:a:pexip:pexip_infinity:40.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64CD3049-810D-4C5C-BD91-86A61EECAE8A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}