CVE-2025-53786
published 2025-08-06CVE-2025-53786: On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these…
PriorityP349high8CVSS 3.1
AVNACHPRHUINSCCHIHAH
EPSS
7.45%
93.8th percentile
On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server_subscription_edition | < 15.02.2562.017 | 15.02.2562.017 |
| microsoft | microsoft_exchange_server_2016_cumulative_update_23 | >= 15.01.0.0 < 15.01.2507.055 | 15.01.2507.055 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_14 | >= 15.02.0.0 < 15.02.1544.025 | 15.02.1544.025 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_15 | >= 15.02.0.0 < 15.02.1748.024 | 15.02.1748.024 |
| microsoft | microsoft_exchange_server_subscription_edition_rtm | >= 15.02.0.0 < 15.02.2562.017 | 15.02.2562.017 |
| msrc | microsoft_exchange_server_2016_cumulative_update_23 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_14 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_15 | — | — |
| msrc | microsoft_exchange_server_subscription_edition_rtm | — | — |
CVSS provenance
nvdv3.18.0HIGHCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
vendor_msrc8.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v92c-556h-xm93: On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix
ghsa_unreviewed·2025-08-06·CVSS 8.0
CVE-2025-53786 [HIGH] CWE-287 GHSA-v92c-556h-xm93: On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix
On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.
Microsoft
Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability
vendor_msrc·2025-08-12·CVSS 8.0
CVE-2025-53786 [HIGH] CWE-287 Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability
Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability
Description: On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange
No detection rules found.
No public exploits indexed.
Tenable
Tenable Cloud Security FedRAMP: 65% Discount for U.S. Federal Agencies & GSA OneGov | Tenable®
blogs_tenable·2025-12-11
Tenable Cloud Security FedRAMP: 65% Discount for U.S. Federal Agencies & GSA OneGov | Tenable®
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Cybersecurity Snapshot: AI Will Take Center Stage in Cyber in 2026, Google Says, as MITRE Revamps ATT&CK Framework
blogs_tenable·2025-11-07
Cybersecurity Snapshot: AI Will Take Center Stage in Cyber in 2026, Google Says, as MITRE Revamps ATT&CK Framework
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
CISA and NSA share tips on securing Microsoft Exchange servers
blogs_bleepingcomputer·2025-10-30
CISA and NSA share tips on securing Microsoft Exchange servers
## CISA and NSA share tips on securing Microsoft Exchange servers
## Sergiu Gatlan
Additionally, although not addressed by CISA and the NSA's guide, monitoring for malicious or suspicious activity and planning for potential incidents and recovery are equally crucial for mitigating risks associated with on-prem Exchange servers.
"By restricting administrative access, implementing multifactor authentication, enforcing strict transport security configurations, and adopting zero trust (ZT) security model principles, organizations can significantly bolster their defenses against potential cyberattacks," said the two agencies on Thursday, joined by the Australian Cyber Security Centre (ACSC) and the Canadian Centre for Cyber Security (Cyber Centre).
"Additionally, as certain Exchange Server
Wiz
Crying Out Cloud Newsletter - September 2025 | Wiz
blogs_wiz·2025-09-07·CVSS 8.1
[HIGH] Crying Out Cloud Newsletter - September 2025 | Wiz
Welcome back! In this edition, we bring you the latest in cloud security - noteworthy incidents, exclusive data, and crucial vulnerabilities. Let's dive in.
## 🔍 Highlights
s1ngularity: Supply Chain Attack Leaks Secrets on GitHub
On August 26, 2025, multiple malicious versions of the widely used Nx build system package were published to the npm registry. These versions contained a post-installation malware script designed to harvest sensitive developer assets, including cryptocurrency wallets, GitHub and npm tokens, SSH keys, and more. The malware leveraged AI command-line tools (including Claude, Gemini, and Q) to aid in their reconnaissance efforts, and then exfiltrated the stolen data to publicly accessible attacker-created repositories within victims’ GitHub accounts.
Learn more in
Bleepingcomputer
Canada’s House of Commons investigating data breach after cyberattack
blogs_bleepingcomputer·2025-08-14·CVSS 9.8
[CRITICAL] Canada’s House of Commons investigating data breach after cyberattack
## Canada’s House of Commons investigating data breach after cyberattack
## Sergiu Gatlan
Employees and House of Commons members were also urged to be aware of potential fraudulent attempts to use the information stolen during the attack, which could be used to target and impersonate parliamentarians or exploited in scams.
The Canadian Centre for Cyber Security (Cyber Centre), a part of the country's Communications Security Establishment (CSE), told BleepingComputer that it's supporting the House of Commons' ongoing investigation but didn't link the attack to a particular threat group.
"However, we can tell you that we are aware of the incident and working with the House of Commons to provide support," said the Cyber Centre.
"Attribution of a cyber incident is difficult. Investigating
Bleepingcomputer
CISA warns of N-able N-central flaws exploited in zero-day attacks
blogs_bleepingcomputer·2025-08-14·CVSS 9.4
[CRITICAL] CISA warns of N-able N-central flaws exploited in zero-day attacks
## CISA warns of N-able N-central flaws exploited in zero-day attacks
## Sergiu Gatlan
CISA warned on Wednesday that attackers are actively exploiting two security vulnerabilities in N‑able's N-central remote monitoring and management (RMM) platform.
N-central is commonly used by managed services providers (MSPs) and IT departments to monitor, manage, and maintain client networks and devices from a centralized web-based console.
According to CISA, the two flaws can allow authenticated attackers to gain command execution via an insecure deserialization weakness ( CVE-2025-8875 ) and inject commands by exploiting an improper sanitization of user input vulnerability ( CVE-2025-8876 ).
N-able confirms CISA's report that the security bugs are now being exploited in the wild and has patche
Krebs
Microsoft Patch Tuesday, August 2025 Edition
blogs_krebs·2025-08-12·CVSS 7.2
CVE-2025-53786 [HIGH] Microsoft Patch Tuesday, August 2025 Edition
Microsoft today released updates to fix more than 100 security flaws in its Windows operating systems and other software. At least 13 of the bugs received Microsoft’s most-dire “critical” rating, meaning they could be abused by malware or malcontents to gain remote access to a Windows system with little or no help from users.
August’s patch batch from Redmond includes an update for CVE-2025-53786 , a vulnerability that allows an attacker to pivot from a compromised Microsoft Exchange Server directly into an organization’s cloud environment, potentially gaining control over Exchange Online and other connected Microsoft Office 365 services. Microsoft first warned about this bug on Aug. 6, saying it affects Exchange Server 2016 and Exchange Server 2019 , as well as its flagship Exchange Serv
Bleepingcomputer
Microsoft August 2025 Patch Tuesday fixes one zero-day, 107 flaws
blogs_bleepingcomputer·2025-08-12·CVSS 7.2
[HIGH] Microsoft August 2025 Patch Tuesday fixes one zero-day, 107 flaws
## Microsoft August 2025 Patch Tuesday fixes one zero-day, 107 flaws
## Lawrence Abrams
44 Elevation of Privilege Vulnerabilities
35 Remote Code Execution Vulnerabilities
18 Information Disclosure Vulnerabilities
4 Denial of Service Vulnerabilities
9 Spoofing Vulnerabilities
When BleepingComputer reports on the Patch Tuesday security updates, we only count those released on Patch Tuesday. Therefore, the number of flaws does not include Mariner, Azure, and Microsoft Edge bugs fixed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5063878 & KB5063875 cumulative updates and the Windows 10 KB5063709 cumulative update .
## One publicly disclosed zero-day fixed
This month's Patch Tuesday fixes one
Tenable
From Vulnerability to Visibility: What the SharePoint Attacks Reveal About the Need for Proactive Cybersecurity
blogs_tenable·2025-08-12
From Vulnerability to Visibility: What the SharePoint Attacks Reveal About the Need for Proactive Cybersecurity
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Microsoft and Adobe Patch Tuesday, August 2025 Security Update Review | Qualys
blogs_qualys·2025-08-12
Microsoft and Adobe Patch Tuesday, August 2025 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for August 2025
- Adobe Patches for August 2025
- Zero-day Vulnerability Patched in August Patch Tuesday Edition
- Critical Severity Vulnerabilities Patched in August Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
- Rapid Response withPatch Management (PM)
- Microsoft July 2025 Patch Tuesday Mitigations
- Qualys Monthly Webinar Series
It’s the second Tuesday of August, and Microsoft has rolled out its latest security updates. Microsoft’s August 2025 Patch Tuesday has arrived, bringing a fresh wave of security fixes to help organizations stay ahead of evolving threats. Here’s a quick breakdown of wh
Talos
Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
blogs_talos·2025-08-12·CVSS 7.8
[HIGH] Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for August 2025, which includes 111 vulnerabilities affecting a range of products, including 13 that Microsoft marked as “critical”.
In this month's release, Microsoft observed none of the included vulnerabilities being actively exploited in the wild. Out of 13 "critical" entries, 9 are remote code execution (RCE) vulnerabilities in Microsoft Windows services and applications including the Windows kernel, Microsoft Message Queuing (MSMQ), Windows Hyper-V, Microsoft Office and GDI+.
CVE-2025-50176 is an RCE vulnerability in DirectX Graphics Kernel given a CVSS 3.1 score of 7.8, where access of resource using incompatible type ('type confusion') in Grap
Talos
Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
blogs_talos·2025-08-12·CVSS 7.8
[HIGH] Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for August 2025, which includes 111 vulnerabilities affecting a range of products, including 13 that Microsoft marked as “critical”.
In this month's release, Microsoft observed none of the included vulnerabilities being actively exploited in the wild. Out of 13 "critical" entries, 9 are remote code execution (RCE) vulnerabilities in Microsoft Windows services and applications including the Windows kernel, Microsoft Message Queuing (MSMQ), Windows Hyper-V, Microsoft Office and GDI+.
CVE-2025-50176 is an RCE vulnerability in DirectX Graphics Kernel given a CVSS 3.1 score of 7.8, where access of resource using incompatible type ('type confusion') in Graphics Kernel allows an authorized attacker to execute code locally. Microsoft has noted t
Krebs
Microsoft Patch Tuesday, August 2025 Edition
blogs_krebs·2025-08-12·CVSS 7.2
CVE-2025-53786 [HIGH] Microsoft Patch Tuesday, August 2025 Edition
Microsoft today released updates to fix more than 100 security flaws in its Windows operating systems and other software. At least 13 of the bugs received Microsoft’s most-dire “critical” rating, meaning they could be abused by malware or malcontents to gain remote access to a Windows system with little or no help from users.
August’s patch batch from Redmond includes an update for CVE-2025-53786, a vulnerability that allows an attacker to pivot from a compromised Microsoft Exchange Server directly into an organization’s cloud environment, potentially gaining control over Exchange Online and other connected Microsoft Office 365 services. Microsoft first warned about this bug on Aug. 6, saying it affects Exchange Server 2016 and Exchange Server 2019, as well as its flagship Exchange Server
Qualys
Microsoft and Adobe Patch Tuesday, August 2025 Security Update Review
blogs_qualys·2025-08-12
Microsoft and Adobe Patch Tuesday, August 2025 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for August 2025
Adobe Patches for August 2025
Zero-day Vulnerability Patched in August Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in August Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withPatch Management (PM)
Microsoft July 2025 Patch Tuesday Mitigations
Qualys Monthly Webinar Series
It’s the second Tuesday of August, and Microsoft has rolled out its latest security updates. Microsoft’s August 2025 Patch Tuesday has arrived, bringing a fresh wave of security fixes to help organizations stay ahead of evolving threats. Here’s a quick breakdown of what you need t
Bleepingcomputer
Over 29,000 Exchange servers unpatched against high-severity flaw
blogs_bleepingcomputer·2025-08-11·CVSS 8.0
[HIGH] Over 29,000 Exchange servers unpatched against high-severity flaw
## Over 29,000 Exchange servers unpatched against high-severity flaw
## Sergiu Gatlan
The flaw was disclosed after Microsoft released guidance and an Exchange server hotfix in April 2025 as part of its Secure Future Initiative, which supports a new architecture using a dedicated hybrid app that replaces the insecure shared identity previously used by on-premises Exchange Server and Exchange Online.
While Redmond has not yet found evidence of abuse in attacks, the vulnerability was still tagged as "Exploitation More Likely" because Redmond considers that exploit code allowing consistent exploitation could be developed, increasing its attractiveness to attackers.
According to scans from the security threat monitoring platform Shadowserver, more than 29,000 Exchange servers are still unpa
Tenable
Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework
blogs_tenable·2025-08-08
Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
CISA orders fed agencies to patch new Exchange flaw by Monday
blogs_bleepingcomputer·2025-08-07·CVSS 8.0
CVE-2025-53786 [HIGH] CISA orders fed agencies to patch new Exchange flaw by Monday
## CISA orders fed agencies to patch new Exchange flaw by Monday
## Lawrence Abrams
CISA has issued an emergency directive ordering all Federal Civilian Executive Branch (FCEB) agencies to mitigate a critical Microsoft Exchange hybrid vulnerability tracked as CVE-2025-53786 by Monday morning at 9:00 AM ET.
Federal Civilian Executive Branch (FCEB) agencies are non-military agencies within the US executive branch, including the Department of Homeland Security, Department of the Treasury, Department of Energy, and Department of Health and Human Services.
The flaw tracked as CVE-2025-53786 allows attackers who gain administrative access to on-premises Exchange servers to move laterally into Microsoft cloud environments, potentially leading to complete domain compromise.
The vulnerability
Bleepingcomputer
Microsoft warns of high-severity flaw in hybrid Exchange deployments
blogs_bleepingcomputer·2025-08-07·CVSS 8.0
[HIGH] Microsoft warns of high-severity flaw in hybrid Exchange deployments
## Microsoft warns of high-severity flaw in hybrid Exchange deployments
## Sergiu Gatlan
Microsoft has warned customers to mitigate a high-severity vulnerability in Exchange Server hybrid deployments that could allow attackers to escalate privileges in Exchange Online cloud environments undetected.
Exchange hybrid configurations connect on-premises Exchange servers to Exchange Online (part of Microsoft 365), allowing for seamless integration of email and calendar features between on-premises and cloud mailboxes, including shared calendars, global address lists, and mail flow.
However, in hybrid Exchange deployments, on-prem Exchange Server and Exchange Online also share the same service principal, which is a shared identity used for authentication between the two environments.
By abus
Tenable
CVE-2025-53786: Frequently Asked Questions About Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability
blogs_tenable·2025-08-07·CVSS 8.0
[HIGH] CVE-2025-53786: Frequently Asked Questions About Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
2025-08-06
Published