Microsoft Alerts Users to Critical Vulnerability in Hybrid Exchange Deployments
Microsoft has issued a warning to customers regarding a high-severity vulnerability in Exchange Server hybrid deployments, which could enable attackers to escalate their privileges in Exchange Online cloud environments without leaving detectable traces. Exchange hybrid configurations connect on-premises Exchange servers to Exchange Online, part of Microsoft 365, facilitating seamless integration of email and calendar features between on-premises and cloud mailboxes. However, in these hybrid deployments, both the on-premises Exchange Server and Exchange Online share the same service principal, a shared identity used for authentication. By exploiting this shared identity, attackers who gain control of the on-premises Exchange can forge or manipulate trusted tokens or API calls that the cloud environment will accept as legitimate, as it implicitly trusts the on-premises server. Furthermore, actions originating from the on-premises Exchange may not generate logs associated with malicious behaviour in Microsoft 365, meaning traditional cloud-based auditing may fail to capture security breaches originating from on-premises systems.
The vulnerability, tracked as CVE-2025-53786, affects Exchange Server 2016, Exchange Server 2019, and the Microsoft Exchange Server Subscription Edition. Although Microsoft has not yet observed in-the-wild exploitation, it has classified the vulnerability as “Exploitation More Likely,” indicating that exploit code could be developed to consistently exploit this flaw, making it more appealing to attackers. The Cybersecurity and Infrastructure Security Agency (CISA) has also issued an advisory on this issue, recommending that network defenders secure their Exchange hybrid deployments against potential attacks targeting CVE-2025-53786. Suggested mitigation steps include installing Microsoft’s April 2025 Exchange Server Hotfix Updates on the on-premises Exchange server, deploying a dedicated Exchange hybrid app, and reviewing Microsoft’s Service Principal Clean-Up Mode for guidance on resetting the service principal’s key credentials. CISA has cautioned that failing to address this vulnerability could lead to significant security risks within hybrid cloud and on-premises environments.
Categories: Cybersecurity, Vulnerability Management, Exchange Server
Tags: Vulnerability, Exchange Server, Hybrid Deployments, Privilege Escalation, Microsoft 365, Service Principal, Authentication, Security Advisory, CISA, Hotfix Updates