Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 15.01.2507.055, 15.02.1544.025, 15.02.1748.024, 15.02.2562.017
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Microsoft Microsoft Exchange Server 2016 Cumulative Update 23
From 15.01.0.0 · fixed in 15.01.2507.055
- Microsoft Microsoft Exchange Server 2019 Cumulative Update 14
From 15.02.0.0 · fixed in 15.02.1544.025
- Microsoft Microsoft Exchange Server 2019 Cumulative Update 15
From 15.02.0.0 · fixed in 15.02.1748.024
- Microsoft Microsoft Exchange Server Subscription Edition RTM
From 15.02.0.0 · fixed in 15.02.2562.017