CVE-2025-53786

Estado: AnalizadaAlta (8)—

On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 7.71%
Percentil entre todas las CVEs puntuadas: 94
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement75 %
Impacto principalT1078 Valid Accountsstealth · persistence · privilege escalation · initial access80 %
Impacto secundarioT1068 Exploitation for Privilege Escalationprivilege escalation70 %

CWE-287 (autenticación defectuosa) en Exchange con AV:N y PR:H sugiere acceso remoto que requiere privilegios previos. El impacto de credenciales comprometidas (T1078) y potencial escalada de privilegios en híbrido es evidente del contexto de cambios de seguridad.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Privileged Account Management Application Isolation and Sandboxing Exploit Protection Update Software Application Developer Guidance

Tecnologías afectadas (2)

Microsoft — Exchange Server Microsoft — Exchange Server Subscription Edition

CWE

CWE-287

Referencias

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53786

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-53786",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53786",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-07T03:55:25.589098Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft Exchange Server 2016 Cumulative Update 23",
          "versions": [
            {
              "status": "affected",
              "version": "15.01.0.0",
              "lessThan": "15.01.2507.055",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Exchange Server 2019 Cumulative Update 14",
          "versions": [
            {
              "status": "affected",
              "version": "15.02.0.0",
              "lessThan": "15.02.1544.025",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Exchange Server 2019 Cumulative Update 15",
          "versions": [
            {
              "status": "affected",
              "version": "15.02.0.0",
              "lessThan": "15.02.1748.024",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Exchange Server Subscription Edition RTM",
          "versions": [
            {
              "status": "affected",
              "version": "15.02.0.0",
              "lessThan": "15.02.2562.017",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        }
      ]
    }
  ],
  "published": "2025-08-06T16:15:30.700",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53786",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment."
    },
    {
      "lang": "es",
      "value": "El 18 de abril de 2025, Microsoft anunció cambios de seguridad en Exchange Server para implementaciones híbridas y la corrección urgente correspondiente, no relacionada con la seguridad. Microsoft implementó estos cambios con el objetivo general de mejorar la seguridad de las implementaciones híbridas de Exchange. Tras una investigación más exhaustiva, Microsoft identificó implicaciones de seguridad específicas relacionadas con las instrucciones y los pasos de configuración descritos en el anuncio de abril. Microsoft publica la vulnerabilidad CVE-2025-53786 para documentar una vulnerabilidad que se soluciona siguiendo los pasos documentados en el anuncio del 18 de abril. Microsoft recomienda encarecidamente leer la información, instalar la corrección urgente de abril de 2025 (o posterior) e implementar los cambios en su Exchange Server y entorno híbrido."
    }
  ],
  "lastModified": "2026-06-17T09:38:53.090",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF76AEDA-E574-40ED-B64F-8FDEF8CAC802"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C98993B-82A5-48CC-947F-896CEA0CDB7F"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7166BCE0-1D55-46B2-96B9-250AB4BB6291"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "555929AA-7FEA-4066-B1AA-EF09CB0A5BF9",
              "versionEndExcluding": "15.02.2562.017"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}