On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.
\n","cweList":["CWE-287: Improper Authentication"],"cweDetailsListForSearch":["cwe: CWE-287: Improper Authentication","cweUrl: https://cwe.mitre.org/data/definitions/287.html"],"unformattedDescription":"On April 18th 2025, Microsoft announced [Exchange Server Security Changes for Hybrid Deployments](https://techcommunity.microsoft.com/blog/exchange/exchange-server-security-changes-for-hybrid-deployments/4396833) and accompanying non-security [Hot Fix](https://techcommunity.microsoft.com/blog/exchange/released-april-2025-exchange-server-hotfix-updates/4402471). Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.","mitreText":"CVE-2025-53786","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2025-53786","publiclyDisclosed":"No","exploited":"No","latestSoftwareReleaseId":1,"latestSoftwareRelease":"Exploitation More Likely","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"Microsoft Exchange Server","issuingCna":"Microsoft","issuingCnaId":100000001,"severityId":100000001,"severity":"Important","impactId":100000002,"impact":"Elevation of Privilege","langCode":"en-US","baseScore":"8.0","temporalScore":"7.0","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-287: Improper Authentication","https://cwe.mitre.org/data/definitions/287.html"]}],"articles":[{"articleType":"FAQ","description":"What privileges could be gained by an attacker who successfully exploited the vulnerability within the organization\u2019s cloud environment?
\nIn an Exchange hybrid deployment, an attacker who first gains administrative access to an on-premises Exchange server could potentially escalate privileges within the organization\u2019s connected cloud environment without leaving easily detectable and auditable trace. This risk arises because Exchange Server and Exchange Online share the same service principal in hybrid configurations.
\n","ordinal":10000},{"articleType":"FAQ","description":"According to the CVSS metric, successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
\nIn this scenario, successfully exploiting the vulnerability could enable an attacker to escalate privileges within the organization\u2019s connected cloud environment without leaving easily detectable and auditable traces.
\n","ordinal":10000},{"articleType":"FAQ","description":"According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
\nSuccessful exploitation of this vulnerability requires an attacker to first gain or possess administrator access on an Exchange Server.
\n","ordinal":10000},{"articleType":"FAQ","description":"Microsoft Exchange Server Subscription Edition RTM didn't exist in April when the hot fix was released. Why is it listed in the Security Updates Table?
\nSupport for the dedicated Exchange hybrid app feature is already part of the initial release of the Exchange Server SE version. If you have already migrated to the newest version you already have this level of protection from the vulnerability. All you need to do is to follow the steps as outlined in the documentation to enable the feature and clear the certificates from the shared service principals keyCredentials.
\n","ordinal":10000},{"title":"Microsoft Exchange Server Elevation of Privilege Vulnerability","articleType":"100000000","description":"Improper authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
\n","ordinal":10000},{"articleType":"FAQ","description":"Is there new information that I should be aware of?
\nYes, please see this blog post for more information: MDVM Guidance for CVE-2025-53786: Exchange Hybrid Privilege Escalation
\nWhat steps do I need to take to better protect my hybrid environment?
\nIf you're using Exchange hybrid, install the Hot Fix (or newer release) on your on-premises Exchange servers and follow the configuration instructions outlined in Deploy dedicated Exchange hybrid app. For additional details, refer to Exchange Server Security Changes for Hybrid Deployments. After completing the steps, be sure to reset the service principal's keyCredentials.
\nIf you\u2019ve previously configured Exchange hybrid or OAuth authentication between Exchange Server and your Exchange Online organization but no longer use it, make sure to reset the service principal's keyCredentials.
\nInformation published.
\n","unformattedDescription":"Information published.","notificationNeeded":true,"notificationSent":true,"sourceId":"da712065-5e71-f011-93eb-000d3afbc7d7"},{"cveNumber":"CVE-2025-53786","version":1.1,"revisionDate":"2025-08-13T07:00:00Z","initialDate":"0001-01-01T00:00:00Z","description":"Updated FAQ information. This is an informational change only.
\n","unformattedDescription":"Updated FAQ information. This is an informational change only.","notificationNeeded":true,"notificationSent":true,"sourceId":"ed81b455-ab78-f011-93eb-000d3afbc7d7"}]}]}