CVE‑2025‑53786: Critical Vulnerability in Hybrid Exchange Environments
On April 18, 2025, Microsoft released a hotfix and new configuration instructions to improve security in Hybrid Exchange environments. However, some configurations related to these steps were subsequently implemented incorrectly or incompletely, leading to the discovery of a security vulnerability (CVE‑2025‑53786). In an Exchange Hybrid deployment, an attacker who gains administrative access to an on-premises Exchange server could escalate privileges in the organization's connected cloud environment without leaving an easily identifiable and auditable trace. This risk exists because Exchange Server and Exchange Online share the same service principal in Hybrid configurations.
Affected Versions:
- Exchange Server 2016 Cumulative Update 23 (CU23)
- Exchange Server 2019 Cumulative Update 14 (CU14) ve CU15
- Exchange Server Subscription Edition RTM
To avoid being affected by this vulnerability, the April 2025 or later Hotfix must be installed. If you have a Hybrid Exchange architecture, it is recommended that you promptly apply the released updates and configuration guidelines for CVE‑2025‑53786. For more information:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53786
