Auth bypass in Microsoft Exchange Server
CVE-2025-53786
On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.
Vulnerability class: Broken Authentication
EPSS: 0.074 (94.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Microsoft Exchange_server — versions 2016, 2019
- Microsoft Exchange_server_subscription_edition
- Microsoft Exchange Server 2016 Cumulative Update 23 — versions 15.01.0.0
- Microsoft Exchange Server 2019 Cumulative Update 14 — versions 15.02.0.0
- Microsoft Exchange Server 2019 Cumulative Update 15 — versions 15.02.0.0
- Microsoft Exchange Server Subscription Edition Rtm — versions 15.02.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secure@microsoft.com (vendor-advisory, patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-53786?
- CVE-2025-53786 is a high-severity vulnerability in Microsoft Exchange Server, classified under Improper Authentication. CVSS score: 8.0/10. Published 2025-08-06.
- How severe is CVE-2025-53786?
- High severity. CVSS v3 base score is 8.0 out of 10.
- Is CVE-2025-53786 known to be exploited?
- 11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.