CVE-2025-53786

8.0

HIGH CVSS 3.1

Microsoft Exchange Server Hybrid Deployment Authentication Bypass Vulnerability

Description

On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.

INFO

Published Date :

Aug. 6, 2025, 4:15 p.m.

Last Modified :

Aug. 6, 2025, 8:23 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

Affected Products

The following products are affected by CVE-2025-53786 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Microsoft	exchange_server_se
2	Microsoft	exchange_server_2019
3	Microsoft	exchange_server_2016

: Total Affected Vendor : 1 | Products : 3

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				[email protected]

Solution

Apply the Microsoft Hot Fix and implement security changes for hybrid Exchange deployments.

Install the April 2025 (or later) Hot Fix.
Implement the security changes for hybrid deployments.
Review Microsoft's security guidance for Exchange Server.

Public PoC/Exploit Available at Github

CVE-2025-53786 has a 5 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-53786.

URL	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53786

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-53786 is associated with the following CWEs:

CWE-287: Improper Authentication

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-53786 weaknesses.

CAPEC-22: Exploiting Trust in Client Exploiting Trust in Client CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data Utilizing REST's Trust in the System Resource to Obtain Sensitive Data CAPEC-94: Adversary in the Middle (AiTM) Adversary in the Middle (AiTM) CAPEC-114: Authentication Abuse Authentication Abuse CAPEC-115: Authentication Bypass Authentication Bypass CAPEC-151: Identity Spoofing Identity Spoofing CAPEC-194: Fake the Source of Data Fake the Source of Data CAPEC-593: Session Hijacking Session Hijacking CAPEC-633: Token Impersonation Token Impersonation CAPEC-650: Upload a Web Shell to a Web Server Upload a Web Shell to a Web Server

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

CloudCodeCreators/Code

This repository contains a curated set of PowerShell scripts for Exchange environments, Microsoft 365, Azure, Intune and many more to come. Stay tuned!

automation cyber-security devops exchange exchange-online microsoft-365-desired-state-configuration

PowerShell

Updated: 1 week, 3 days ago

0 stars 0 fork 0 watcher

Born at : Aug. 15, 2025, 11:58 a.m. This repo has been linked 1 different CVEs too.

barbaraeivyu/barbaraeivyu

None

Updated: 1 week, 5 days ago

0 stars 0 fork 0 watcher

Born at : Aug. 9, 2025, 9:26 p.m. This repo has been linked 2 different CVEs too.

barbaraeivyu/CVE-2025-53786

None

Updated: 2 weeks, 5 days ago

0 stars 0 fork 0 watcher

Born at : Aug. 8, 2025, 9:46 a.m. This repo has been linked 1 different CVEs too.

yembors64632/cve_monitor_Public

None

Updated: 2 weeks ago

1 stars 0 fork 0 watcher

Born at : July 23, 2025, 11:54 a.m. This repo has been linked 88 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 1 day, 2 hours ago

7221 stars 1200 fork 1200 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 804 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-53786 vulnerability anywhere in the article.

BleepingComputer

Canada’s House of Commons investigating data breach after cyberattack

The House of Commons of Canada is currently investigating a data breach after a threat actor reportedly stole employee information in a cyberattack on Friday. While the lower house of the Parliament o ...

Published Date: Aug 14, 2025 (1 week, 6 days ago)

BleepingComputer

CISA warns of N-able N-central flaws exploited in zero-day attacks

CISA warned on Wednesday that attackers are actively exploiting two security vulnerabilities in N‑able's N-central remote monitoring and management (RMM) platform. N-central is commonly used by manag ...

Published Date: Aug 14, 2025 (1 week, 6 days ago)

The Cyber Express

Microsoft Teams CVE-2025-53783 Vulnerability Could Allow Remote Code Execution

Microsoft has disclosed a serious vulnerability in its collaboration platform, Microsoft Teams, that could open the door to Remote Code Execution (RCE) attacks. The flaw, tracked as CVE-2025-53783, ca ...

Published Date: Aug 13, 2025 (2 weeks ago)

Help Net Security

Microsoft fixes “BadSuccessor” Kerberos vulnerability (CVE-2025-53779)

For August 2025 Patch Tuesday, Microsoft has released security updates resolving 100+ security vulnerabilities in its various solutions, including a relative path traversal flaw in Windows Kerberos (C ...

Published Date: Aug 13, 2025 (2 weeks ago)

The Hacker News

Microsoft August 2025 Patch Tuesday Fixes Kerberos Zero-Day Among 111 Total New Flaws

Microsoft on Tuesday rolled out fixes for a massive set of 111 security flaws across its software portfolio, including one flaw that has been disclosed as publicly known at the time of the release. Of ...

Published Date: Aug 13, 2025 (2 weeks, 1 day ago)

krebsonsecurity.com

Microsoft Patch Tuesday, August 2025 Edition

Microsoft today released updates to fix more than 100 security flaws in its Windows operating systems and other software. At least 13 of the bugs received Microsoft’s most-dire “critical” rating, mean ...