Microsoft has issued a warning about a high-severity vulnerability in hybrid Microsoft Exchange Server deployments.
Tracked as CVE-2025-53786, the vulnerability could allow for privilege escalation by cyber threat actors with administrative access to an on-premise Microsoft Exchange server. Although there is not currently any indication of active exploitation, the issue is considered extremely serious and requires immediate attention.
The vulnerability was discovered some time ago, as is clear from the announcement made by Microsoft. In an advisory posted to MSRC, the company says:
On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.
The fact that there is a hotfix available is clearly good news, but questions will be asked about why it took Microsoft so long to raise awareness of such a serious security issue.
Exchange vulnerability
In addition to Microsoft’s warning and advice, there is also information from CISA:
- If using Exchange hybrid, review Microsoft’s guidance Exchange Server Security Changes for Hybrid Deployments to determine if your Microsoft hybrid deployments are potentially affected and available for a Cumulative Update (CU).
- Install Microsoft’s April 2025 Exchange Server Hotfix Updates on the on-premise Exchange server and follow Microsoft’s configuration instructions Deploy dedicated Exchange hybrid app.
- For organizations using Exchange hybrid (or have previously configured Exchange hybrid but no longer use it), review Microsoft’s Service Principal Clean-Up Mode for guidance on resetting the service principal’s keyCredentials.
- Upon completion, run the Microsoft Exchange Health Checker to determine if further steps are required.
The security organization also says:
CISA highly recommends entities disconnect public-facing versions of Exchange Server or SharePoint Server that have reached their end-of-life (EOL) or end-of-service from the internet. For example, SharePoint Server 2013 and earlier versions are EOL and should be discontinued if still in use.
Microsoft has also provided an FAQ as a source of useful information:
What privileges could be gained by an attacker who successfully exploited the vulnerability within the organization’s cloud environment?
In an Exchange hybrid deployment, an attacker who first gains administrative access to an on-premises Exchange server could potentially escalate privileges within the organization’s connected cloud environment without leaving easily detectable and auditable trace. This risk arises because Exchange Server and Exchange Online share the same service principal in hybrid configurations.
According to the CVSS metric, successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
In this scenario, successfully exploiting the vulnerability could enable an attacker to escalate privileges within the organization’s connected cloud environment without leaving easily detectable and auditable traces.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to first gain or possess administrator access on an Exchange Server.
Microsoft Exchange Server Subscription Edition RTM didn’t exist in April when the hot fix was released. Why is it listed in the Security Updates Table?
Support for the dedicated Exchange hybrid app feature is already part of the initial release of the Exchange Server SE version. If you have already migrated to the newest version you already have this level of protection from the vulnerability. All you need to do is to follow the steps as outlined in the documentation to enable the feature and clear the certificates from the shared service principals keyCredentials.
Image credit: Davide Bonaldo / Dreamstime.com
