Critical Path Acquires Innovative Public Key Infrastructure Technology; Critical Path Will Strengthen Guaranteed Delivery Offering With Acquisition of XETI.

SAN FRANCISCO--(BUSINESS WIRE)--Nov. 23, 1999--

Critical Path, Inc. (Nasdaq:CPTH), a leading provider of business-to-business Internet-based messaging and collaboration solutions for corporations, Web portals, Web hosting companies and ISPs, today announced it acquired XETI, Inc., a leading developer of standards-based public key infrastructure (PKI) solutions.

The acquisition will enhance Critical Path's guaranteed delivery service offerings by providing PKI certificate interoperability giving customers the ultimate in functionality, flexibility and choice.

"Guaranteed delivery services are essential for e-business and communications on the Web today," said Doug Hickey, Critical Path's president and CEO. "People need to be confident that mission critical or confidential messages or documents are delivered to the intended recipient and that they have not been altered in any way.

"The acquisition of XETI further strengthens Critical Path's guaranteed delivery services with essential PKI technology providing customers with ubiquitous access to digital certificates.

"Critical Path is dedicated to staying at the forefront of technology and to quickly bringing to market the most complete suite of solutions that satisfies the full range of email and messaging demands presented by customers and prospects."

XETI, founded in 1997, has developed PKI technology which will further strengthen the security features of Critical Path's Internet messaging solutions. PKI technology provides complete end-to-end message content and file attachment encryption, and addresses critical security features including: -0-

--   Confidentiality -- ensures that the contents of emails and
     electronic documents will not be disclosed to unauthorized
     individuals

--   Data Integrity -- ensures that the contents of the message
     received have not been altered in any way

--   Authentication -- verifies the identities of the parties involved
     in electronic messaging

--   Access Control -- ensures a users messages are not accessible
     from unauthorized individuals

--   Non-Repudiation -- ensures through digital signatures that the
     sender of a signed transaction cannot deny or repudiate the
     contents of the message

About Critical Path, Inc.

Critical Path, Inc. (Nasdaq:CPTH) is a leading provider of business-to-business Internet-based messaging and collaboration solutions for corporations, Internet service providers (ISPs), Web hosting companies, and Web portals.

Critical Path has built an industry-leading global infrastructure with data centers connected to key Internet exchange points, and currently reaches millions of end-users through its customer relationships.

Critical Path provides reliable, secure, and scalable email, and a flexible suite of enhanced messaging services to partners such as E-TRADE, CompuServe, AltaVista, Network Solutions, U S West, Sprint, and ICQ.

Critical Path is headquartered in San Francisco, with offices in locations nationwide and in Germany and the UK. More information on Critical Path can be found at www.cp.net.

Note to Editors: Critical Path and the Critical Path logo are the trademarks of Critical Path, Inc. All other trademarks are the property of their holders.

This press release contains forward-looking statements. These statements may be identified by the use of words such as "believes," "expects," "anticipates," "intends," and "plans." Actual results may differ materially from those anticipated in these forward-looking statements. These forward-looking statements are based on current expectations that are subject to risks and uncertainties, including those relating to the possible inability to complete the acquisition as scheduled or at all. These risks and uncertainties include those that exist with Critical Path's and Xeti's respective business operations. These risks and uncertainties also include those that relate to the proposed acquisition including risks that integration of the operations, technologies and products of the combined companies might not occur as anticipated, that management attention might be diverted from day-to-day business activities of both companies during the period through the closing and thereafter, and that greater than normal employee turnover might occur prior to and after the closing. Whether or not the proposed acquisition closes, actual results of Critical Path, including Critical Path's results of operations, may differ materially from historical results. For a more detailed description of the risks related to Critical Path, please refer to Critical Path's prospectus dated June 1, 1999, which has been filed with the SEC.