【Vulnerability Alert】Microsoft Exchange Server has a major security vulnerability (CVE-2025-53786)
Subject: 【Vulnerability Alert】Microsoft Exchange Server has a major security vulnerability (CVE-2025-53786)
Details:
Forwarded from Taiwan Computer Emergency Response Team/Coordination Center TWCERTCC-200-202508-00000004
Microsoft has issued a major security vulnerability announcement (CVE-2025-53786, CVSS: 8.0) for its Exchange Server product. This vulnerability allows an attacker with administrative privileges to elevate their privileges in hybrid cloud-on-premise environments. Currently, log monitoring tools in cloud environments cannot record malicious activity related to this vulnerability.
A related PoC for this vulnerability was publicly demonstrated at the recent Black Hat conference in the United States, which may accelerate subsequent exploitation by attackers. Microsoft has released security updates and provided temporary mitigation measures. It is recommended to take temporary mitigation measures as soon as possible to prevent potential attacks exploiting this vulnerability.
Affected Platforms:
Microsoft Exchange Server Subscription Edition RTM versions 15.02.0.0 to 15.02.2562.017
Microsoft Exchange Server 2016 Cumulative Update 23 versions 15.01.0 to 15.01.2507.055
Microsoft Exchange Server 2019 Cumulative Update 14 versions 15.02.0.0 to 15.02.1544.025
Microsoft Exchange Server 2019 Cumulative Update 15 versions 15.02.0 to 15.02.1748.024