Skip to content
Fencer Vulns
high 8.0

CVE-2025-53786 json

Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability

published 2025-08-06 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-23857

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
8.0%
EPSS 8.0% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.

Patch / fix

  • Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.055
  • Microsoft Microsoft Exchange Server 2019 Cumulative Update 14 15.02.1544.025
  • Microsoft Microsoft Exchange Server 2019 Cumulative Update 15 15.02.1748.024
  • Microsoft Microsoft Exchange Server Subscription Edition RTM 15.02.2562.017

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
15 mo ago

Exploit prediction

8.03% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Microsoft Microsoft Exchange Server 2016 Cumulative Update 23
  • Microsoft Microsoft Exchange Server 2019 Cumulative Update 14
  • Microsoft Microsoft Exchange Server 2019 Cumulative Update 15
  • Microsoft Microsoft Exchange Server Subscription Edition RTM

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.