Warning: Microsoft Releases Guidance on Critical Vulnerability in Microsoft Exchange Server - Hybrid Exchange Deployments, Patch Immediately!

• Last update: 07/08/2025
• Affected software:
  → Microsoft Exchange Server in Hybrid Exchange Deployments
• Type: Elevation of Privilege
• CVE/CVSS
  → CVE-2025-53786: CVSS 8.0 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)

Sources

Microsoft- https://techcommunity.microsoft.com/blog/exchange/dedicated-hybrid-app-temporary-enforcements-new-hcw-and-possible-hybrid-function/4440682

Risks

CVE-2025-53786 is a high-severity vulnerability affecting Microsoft Exchange hybrid environments. It allows an attacker with administrative access to an on-premises Exchange Server to escalate privileges into the connected Exchange Online environment. The vulnerability can impact the confidentiality, integrity, and availability of affected systems.

The escalation of privileges can occur without triggering standard cloud audit logs, making detection difficult. Microsoft has rated the vulnerability with a CVSS score of 8.0 and strongly recommends that organisations take immediate action to mitigate the risk. There is no active exploitation observed yet.

Description

CVE-2025-53786 is a high-severity vulnerability in Microsoft Exchange hybrid environments that stems from the use of a shared service principal between on-premises Exchange Servers and Exchange Online. This shared identity model allows certain hybrid features such as free/busy calendar lookups, MailTips, and profile picture sharing, but also introduces a risk. If an attacker compromises the on-premises Exchange Server, they could leverage the shared service principal to escalate privileges within the organisation’s connected cloud environment without leaving easily detectable and auditable traces. This risk arises because Exchange Server and Exchange Online share the same service principal in hybrid configurations.

Successful exploitation of this vulnerability requires an attacker first to gain or possess administrator access on an Exchange Server.

To address this risk, Microsoft is phasing out the use of the shared service principal. Beginning in August 2025, temporary blocks on Exchange Web Services (EWS) traffic using the shared principal will be enforced, leading up to a permanent block after October 31, 2025. Organisations must transition to the dedicated Exchange Hybrid Application and update their Exchange servers to supported versions to maintain hybrid functionality and eliminate this security exposure.

Recommended Actions

Patch
The Centre for Cybersecurity Belgium strongly recommends following Microsoft’s guidance on mitigating the vulnerability:

• If using Exchange hybrid, review Microsoft’s guidance to determine if your Microsoft hybrid deployments are potentially affected and available for a Cumulative Update (CU). https://techcommunity.microsoft.com/blog/exchange/exchange-server-security-changes-for-hybrid-deployments/4396833
• Install Microsoft’s April 2025 Exchange Server Hotfix Updates (https://techcommunity.microsoft.com/blog/exchange/released-april-2025-exchange-server-hotfix-updates/4402471) on the on-premise Exchange server and follow Microsoft’s configuration instructions to deploy the dedicated Exchange hybrid app https://learn.microsoft.com/en-us/Exchange/hybrid-deployment/deploy-dedicated-hybrid-app .
• For organisations using Exchange hybrid (or that have previously configured Exchange hybrid but no longer use it), review Microsoft’s Service Principal Clean-Up Mode for guidance on resetting the service principal’s keyCredentials.
• Upon completion, run the Microsoft Exchange Health Checker https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/ to determine if further steps are required.

Monitor/Detect
The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion. Trend Micro advised to review remote access to critical systems and ensure policies and perimeter security are up-to-date.

In case of an intrusion, you can report an incident via https://ccb.belgium.be/en/cert/report-incident.

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.

References

Microsoft - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53786
CISA - https://www.cisa.gov/news-events/alerts/2025/08/06/microsoft-releases-guidance-high-severity-vulnerability-cve-2025-53786-hybrid-exchange-deployments