CVE-2025-53786: Microsoft Exchange Server improper authentication in hybrid deployments

CVE-2025-53786 · Severity: high · CVSS 8 · Published 2025-08-06

Microsoft Exchange Server, a widely used corporate email and calendaring platform, contains a security vulnerability affecting hybrid cloud-on-premises deployments. If exploited, an attacker could potentially bypass authentication mechanisms to gain unauthorized access to sensitive communications or administrative functions. Microsoft has released a security update and specific configuration guidance to address this risk and protect organizational data.

Technologies: Microsoft Exchange Server. Vendors: Microsoft.

Quick answers

Is CVE-2025-53786 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-53786 being exploited in the wild.
How severe is CVE-2025-53786?
High severity, with a CVSS score of 8, published 6 August 2025.
Which products and versions are affected?
Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Exchange Server Subscription Edition.
Is there a fix for CVE-2025-53786?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-53786 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-53786?
Check whether you run Microsoft Exchange Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as Improper Authentication (CWE-287) within Microsoft Exchange Server hybrid deployments. The flaw stems from specific security implications in the configuration steps and guidance previously provided for hybrid environments. An attacker with high privileges can exploit this over the network, though the attack complexity is high. Successful exploitation allows for a scope change (S:C), potentially leading to full compromise of confidentiality, integrity, and availability. Microsoft addressed this via the April 2025 Hot Fix and updated configuration guidance.

Affected products

  • Microsoft Exchange Server 2016 Cumulative Update 23
  • Microsoft Exchange Server 2019 Cumulative Update 14
  • Microsoft Exchange Server 2019 Cumulative Update 15
  • Microsoft Exchange Server Subscription Edition

Timeline

  • 2025-04-18: other: Initial security changes and non-security Hot Fix announced
  • 2025-08-06: advisory: CVE-2025-53786 published to document the specific security implications

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.