CVE-2025-53782CWE-303

CVE-2025-53782

High ยท published October 14, 2025

CVSS v3.1
8.4
EPSS
0%
Percentile
28.2
In the wild
Unconfirmed
What it is

โšก An unauthorized attacker can level up their privileges on Microsoft Exchange Server thanks to a misstep in the authentication algorithm! Think of this like a hotel where the front desk mistakenly gives out master keys without verifying the guest's identity. Anyone with that key can access any room, potentially leading to chaos inside! This flaw allows an attacker to gain elevated privileges locally, opening the door to unauthorized access and control over sensitive data. Imagine a breach that lets an intruder not just peek into your files, but also alter or delete them! It's a recipe for absolute disaster.

Put simply

Think of this like a hotel where the front desk mistakenly gives out master keys without verifying the guest's identity. Anyone with that key can access any room, potentially leading to chaos inside! The vulnerability arises from an incorrect implementation of the authentication algorithm in Microsoft Exchange Server, which permits local privilege escalation by unauthorized users.

What to do

This flaw allows an attacker to gain elevated privileges locally, opening the door to unauthorized access and control over sensitive data. Imagine a breach that lets an intruder not just peek into your files, but also alter or delete them! It's a recipe for absolute disaster. To protect yourself, ensure you update to the latest patches released by Microsoft. Review your authentication settings and conduct a thorough audit of all user privileges. This is crucial to fortify your defenses! You've got this! Stay proactive and secure your setup with these steps! ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
8.4 ยท HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00357 ยท 28.2th percentile
Weakness
CWE-303 ยท Incorrect Implementation of Authentication Algorithm
Published
2025-10-14T21:15Z
Affected products (38)
ProductVersionsFixed in
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_server_subscription_edition< 15.02.2562.02915.02.2562.029
References (1)
EPSS history
Timeline
  • 14 OCT 17:00Z
    Microsoft Exchange Server Elevation of Privilege Vulnerability
    cvelistv5