{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "\u003ca href=\"https://twitter.com/_dirkjan\"\u003eDirk-jan Mollema\u003c/a\u003e with \u003ca href=\"https://outsidersecurity.nl/\"\u003eOutsider Security\u003c/a\u003e"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2025-53786 Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53786"
      },
      {
        "category": "self",
        "summary": "CVE-2025-53786 Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-53786.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability",
    "tracking": {
      "current_release_date": "2025-08-13T07:00:00.000Z",
      "generator": {
        "date": "2025-08-15T20:32:07.339Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2025-53786",
      "initial_release_date": "2025-08-12T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-08-12T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2025-08-13T07:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Updated FAQ information. This is an informational change only."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c15.02.2562.017",
            "product": {
              "name": "Microsoft Exchange Server Subscription Edition RTM \u003c15.02.2562.017",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "15.02.2562.017",
            "product": {
              "name": "Microsoft Exchange Server Subscription Edition RTM 15.02.2562.017",
              "product_id": "16792"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Exchange Server Subscription Edition RTM"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c15.02.1748.024",
            "product": {
              "name": "Microsoft Exchange Server 2019 Cumulative Update 15 \u003c15.02.1748.024",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "15.02.1748.024",
            "product": {
              "name": "Microsoft Exchange Server 2019 Cumulative Update 15 15.02.1748.024",
              "product_id": "12502"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Exchange Server 2019 Cumulative Update 15"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c15.01.2507.055",
            "product": {
              "name": "Microsoft Exchange Server 2016 Cumulative Update 23 \u003c15.01.2507.055",
              "product_id": "4"
            }
          },
          {
            "category": "product_version",
            "name": "15.01.2507.055",
            "product": {
              "name": "Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.055",
              "product_id": "12039"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Exchange Server 2016 Cumulative Update 23"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c15.02.1544.025",
            "product": {
              "name": "Microsoft Exchange Server 2019 Cumulative Update 14 \u003c15.02.1544.025",
              "product_id": "3"
            }
          },
          {
            "category": "product_version",
            "name": "15.02.1544.025",
            "product": {
              "name": "Microsoft Exchange Server 2019 Cumulative Update 14 15.02.1544.025",
              "product_id": "12293"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Exchange Server 2019 Cumulative Update 14"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-53786",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "In an Exchange hybrid deployment, an attacker who first gains administrative access to an on-premises Exchange server could potentially escalate privileges within the organization\u2019s connected cloud environment without leaving easily detectable and auditable trace. This risk arises because Exchange Server and Exchange Online share the same service principal in hybrid configurations.",
          "title": "What privileges could be gained by an attacker who successfully exploited the vulnerability within the organization\u2019s cloud environment?"
        },
        {
          "category": "faq",
          "text": "In this scenario, successfully exploiting the vulnerability could enable an attacker to escalate privileges within the organization\u2019s connected cloud environment without leaving easily detectable and auditable traces.",
          "title": "According to the CVSS metric, successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "Successful exploitation of this vulnerability requires an attacker to first gain or possess administrator access on an Exchange Server.",
          "title": "According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "Support for the dedicated Exchange hybrid app feature is already part of the initial release of the Exchange Server SE version. If you have already migrated to the newest version you already have this level of protection from the vulnerability. All you need to do is to follow the steps as outlined in the documentation to enable the feature and clear the certificates from the shared service principals keyCredentials.",
          "title": "Microsoft Exchange Server Subscription Edition RTM didn\u0027t exist in April when the hot fix was released.  Why is it listed in the Security Updates Table?"
        },
        {
          "category": "faq",
          "text": "Yes, please see this blog post for more information: MDVM Guidance for CVE-2025-53786: Exchange Hybrid Privilege Escalation\nIf you\u0027re using Exchange hybrid, install the Hot Fix (or newer release) on your on-premises Exchange servers and follow the configuration instructions outlined in Deploy dedicated Exchange hybrid app. For additional details, refer to Exchange Server Security Changes for Hybrid Deployments. After completing the steps, be sure to reset the service principal\u0027s keyCredentials.\n\nIf you\u2019ve previously configured Exchange hybrid or OAuth authentication between Exchange Server and your Exchange Online organization but no longer use it, make sure to reset the service principal\u0027s keyCredentials.",
          "title": "Is there new information that I should be aware of?"
        }
      ],
      "product_status": {
        "fixed": [
          "12039",
          "12293",
          "12502",
          "16792"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-53786 Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53786"
        },
        {
          "category": "self",
          "summary": "CVE-2025-53786 Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-53786.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-08-12T07:00:00.000Z",
          "details": "15.02.2562.017:Security Update:http://support.microsoft.com/kb/5047155",
          "product_ids": [
            "1"
          ],
          "url": "http://support.microsoft.com/kb/5047155"
        },
        {
          "category": "vendor_fix",
          "date": "2025-08-12T07:00:00.000Z",
          "details": "15.02.1748.024:Security Update:http://support.microsoft.com/kb/KB5050672",
          "product_ids": [
            "2"
          ],
          "url": "http://support.microsoft.com/kb/KB5050672"
        },
        {
          "category": "vendor_fix",
          "date": "2025-08-12T07:00:00.000Z",
          "details": "15.01.2507.055:Security Update:http://support.microsoft.com/kb/KB5050674",
          "product_ids": [
            "4"
          ],
          "url": "http://support.microsoft.com/kb/KB5050674"
        },
        {
          "category": "vendor_fix",
          "date": "2025-08-12T07:00:00.000Z",
          "details": "15.02.1544.025:Security Update:http://support.microsoft.com/kb/KB5050673",
          "product_ids": [
            "3"
          ],
          "url": "http://support.microsoft.com/kb/KB5050673"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "CHANGED",
            "temporalScore": 7.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Elevation of Privilege"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely"
        }
      ],
      "title": "Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability"
    }
  ]
}