CVE-2026-103105

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-30 · updated 2026-10-05
Weakness: CWE-863

Description

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node.

Affected products

Pexip Infinity: before 38.2; from 39.0 through 39.1; 40.0 — fixed in 38.2

How to fix

Upgrade to a fixed version: Pexip Infinity 38.2. Check the vendor advisory for mitigations.

References

https://docs.pexip.com/admin/security_bulletins.htm

Get alerted when CVE-2026-103105 or the next vulnerability affects your stack