Microsoft’s CVE-2025-53786 affects certain Microsoft Exchange Server builds in hybrid deployments. The documented attack path starts with an attacker who already has administrative access to an on-premises Exchange server and could let them escalate privileges into the organization’s connected Exchange Online environment. Organizations should check their build and hybrid history, then complete Microsoft’s prescribed update and configuration steps.
What is CVE-2025-53786?
CERT-EU described the issue as a high-severity vulnerability in Exchange hybrid environments in Security Advisory 2025-030, published 8 August 2025. The advisory says Microsoft issued its own advisory on 6 August 2025. The risk is at the trust boundary between on-premises Exchange and Exchange Online: the described attack path could involve forging or manipulating trusted tokens or API calls accepted by the cloud environment. This is a potential escalation path, not evidence that every hybrid tenant was compromised. CERT-EU says confidentiality, integrity and availability may be affected. CERT-EU Security Advisory 2025-030
TechRadar Pro reported a CVSS score of 8.0 out of 10 and quoted Microsoft as saying an attacker could potentially escalate privileges in the connected cloud environment without leaving an easily detectable and auditable trace. The score and quotation are secondary-source reporting; CERT-EU’s accessible advisory calls the vulnerability high severity but does not provide a numerical score. TechRadar Pro’s 7 August 2025 report
Which Exchange builds were listed as affected?
The following thresholds are those reported by CERT-EU on 8 August 2025 for affected builds in hybrid deployments. A listed build is below the threshold if its version number is earlier than the one shown.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match#1 Best Overall
- Get NVMe solid state performance with up to 1050MB/s read and 1000MB/s write speeds in a portable, high-capacity drive(1) (Based on internal testing; performance may be lower depending on host device & other factors. 1MB=1,000,000 bytes.)
- Up to 3-meter drop protection and IP65 water and dust resistance mean this tough drive can take a beating(3) (Previously rated for 2-meter drop protection and IP55 rating. Now qualified for the higher, stated specs.)
- Use the handy carabiner loop to secure it to your belt loop or backpack for extra peace of mind.
- Help keep private content private with the included password protection featuring 256‐bit AES hardware encryption.(3)
- Easily manage files and automatically free up space with the SanDisk Memory Zone app.(5). Non-Operating Temperature -20°C to 85°C
| Exchange version | Build threshold in the 8 August 2025 advisory |
|---|---|
| Exchange Server 2016 CU23 | Earlier than 15.01.2507.055 |
| Exchange Server 2019 CU14 | Earlier than 15.02.1544.025 |
| Exchange Server 2019 CU15 | Earlier than 15.02.1748.024 |
| Exchange Server Subscription Edition RTM | Earlier than 15.02.2562.017 |
This is a dated advisory list, not a verified exhaustive build matrix for October 2026. Check Microsoft’s current CVE record and Exchange guidance before deciding whether a server is exposed or whether later updates supersede these thresholds. Microsoft Security Response Center CVE-2025-53786 record
How to tell whether your organization needs to act
Compare the server’s Exchange version, cumulative update and full build number against Microsoft’s current guidance. Also establish whether Exchange hybrid is configured now or was configured in the past. CERT-EU recommends that organizations review whether a current hybrid deployment may be affected and determine which cumulative update applies; it also specifically advises organizations that use or previously configured hybrid Exchange to review the service-principal cleanup guidance.
Rank #2
- Solid state performance with up to 800MB/s read speeds in a portable drive. (Based on internal testing; performance may be lower depending on host device, interface, usage conditions and other factors. 1MB=1,000,000 bytes.)
- Back up your content and memories on a storage solution that fits seamlessly into your mobile lifestyle.
- Take it with you on your adventures—up to two-meter drop protection means this durable drive can take a beating. (Based on internal testing.)
- Secure it to your belt loop or backpack for extra peace of mind thanks to the tough rubber hook.
- From Sandisk, a brand professional photographers trust to take on assignments.
- Record each on-premises Exchange server’s version, CU and build.
- Confirm whether the organization currently has, or previously had, an Exchange hybrid configuration.
- Check whether the prescribed hotfix, dedicated hybrid app deployment and service-principal cleanup were completed.
- Run Microsoft Exchange Health Checker and review any remaining actions it identifies.
What should administrators do?
1. Install the applicable Exchange hotfix
Apply Microsoft’s April 2025 Exchange Server hotfix updates to on-premises servers, following the instructions for the relevant Exchange version and cumulative update. Confirm applicability against Microsoft’s current Exchange guidance rather than relying only on the dated threshold list.
2. Deploy the dedicated Exchange hybrid app
Use Microsoft’s configuration instructions to deploy the dedicated Exchange hybrid app. Microsoft’s hybrid security guidance and app documentation are linked here: Exchange hybrid security guidance and dedicated Exchange hybrid app documentation.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #3
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
3. Review service-principal cleanup, including past hybrid configurations
If your organization uses or previously configured Exchange hybrid, review Microsoft’s Service Principal Clean-Up Mode guidance for resetting the service principal’s keyCredentials. Do not assume that removing or ending a hybrid configuration means this review is unnecessary.
4. Run Exchange Health Checker
After completing the update and configuration work, run Microsoft Exchange Health Checker to identify additional required actions. Treat its findings as part of the remediation check, not as a substitute for confirming the hotfix and hybrid-app steps.
Rank #4
- NEARLY 2X FASTER THAN OUR PREVIOUS GENERATION(8) – move 1,000 high-res photos in under 60 seconds(6) with up to 2000MB/s transfer speeds(2).
- IP65 RATING AND UP TO 3M DROP PROTECTION(3) – protects against spills and drops.
- POCKET-SIZED – fits easily in pockets and small bags.
- SPACE TO OWN YOUR AI CONTENT – speed and capacity to download your high-res clips and photo edits.
- 256-BIT AES ENCRYPTION(4) – helps keep private files secure with password protection.
Can administrators hunt for signs of abuse?
CERT-EU’s advisory includes a KQL query for hunting potential abuse of the graph.windows.net API through impersonation, and notes that Microsoft later fixed the behavior. Use the query from the advisory only after validating that it fits your telemetry and current Microsoft guidance. The available advisory does not establish a victim count or prevalence figure, so the vulnerability’s existence alone does not show that a particular tenant was attacked.
Quick Recap
Best Value
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
