Improper authentication in Microsoft Exchange Server - CVE-2025-53786
Published: August 6, 2025
Vulnerability identifier: #VU113714
CSH Severity: Medium
CVSS v4: 5.5 [CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H]
CVE-ID: CVE-2025-53786
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to escalate privileges in hybrid deployments.
The vulnerability exists due to improper authentication. A remote user with privileged access to an on-premises Exchange server can escalate privileges within the organization’s connected cloud environment without leaving easily detectable and auditable trace.
Affected software
Microsoft Exchange Server
How to mitigate CVE-2025-53786
Install updates from vendor's website.
Microsoft Exchange Server - addressed in versions SE RTM 15.02.2562.017, 2016 CU23 Apr25HU 15.01.2507.055, 2019 CU14 Apr25HU 15.02.1544.025, 2019 CU15 Apr25HU 15.02.1748.024