PT-2025-32193 · Microsoft · Exchange Server

Dirk-Jan Mollema

+1

·

Published

2025-04-18

·

Updated

2025-08-31

·

CVE-2025-53786

Report an issue
CVSS v3.1
8.0
VectorAV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

**Name of the Vulnerable Software and Affected Versions:**

Microsoft Exchange Server versions prior to the April 2025 Hot Fix.

**Description:**

A critical elevation of privilege vulnerability exists in Microsoft Exchange Server hybrid deployments. This flaw allows attackers who have gained administrative access to an on-premises Exchange Server to escalate their privileges and potentially compromise cloud environments, including Microsoft 365. The vulnerability stems from a shared service principal used between on-premises and online Exchange environments, enabling attackers to forge trusted tokens for cloud access without generating logs, making detection difficult. Over 29,000 Exchange servers were reported as unpatched and vulnerable as of August 7, 2025. CISA issued an emergency directive mandating federal agencies to patch systems by August 11, 2025.

**Recommendations:**

Apply the April 2025 (or later) Hot Fix and implement the changes documented in the April 18th, 2025 announcement. For hybrid deployments, consider rearchitecting identity boundaries to mitigate the risk of privilege escalation. If you are running hybrid Exchange, ensure you apply the latest security updates and, if applicable, run the mitigation script.

Fix

LPE

RCE

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2025-09477
CVE-2025-53786

Affected Products

Exchange Server