Auth bypass in Microsoft Exchange Server
CVE-2025-53786
On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.077 (94.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 94.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.077 · newest: 0.077 · change: 0.000
Affected products
- Microsoft Exchange Server — versions 2016, 2019
- Microsoft Exchange Server Subscription Edition
- Microsoft Exchange Server 2016 Cumulative Update 23 — versions 15.01.0.0
- Microsoft Exchange Server 2019 Cumulative Update 14 — versions 15.02.0.0
- Microsoft Exchange Server 2019 Cumulative Update 15 — versions 15.02.0.0
- Microsoft Exchange Server Subscription Edition Rtm — versions 15.02.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53786 (vendor-advisory, patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-53786?
- CVE-2025-53786 is a high-severity vulnerability in Microsoft Exchange Server, classified under Improper Authentication. CVSS score: 8.0/10. Published 2025-08-06.
- How severe is CVE-2025-53786?
- High severity. CVSS v3 base score is 8.0 out of 10.
- Is CVE-2025-53786 known to be exploited?
- 11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.