CVE-2025-64666CWE-20

CVE-2025-64666

High · published December 9, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
63.1
In the wild
Unconfirmed
What it is

⚡ An authorized attacker can escalate privileges with a simple input trick in Microsoft Exchange Server. It's like sneaking into a VIP lounge just by filling out a form correctly! Think of it as having access to a restricted area in a building where all you need is to get your paperwork in order — if the security checks aren't solid, anyone could slip through the cracks and gain access they shouldn't have! This vulnerability could lead to an attacker gaining elevated privileges, potentially giving them control over sensitive data or the ability to manipulate server functions. This is no small threat; it could compromise the entire network's integrity!

Put simply

Think of it as having access to a restricted area in a building where all you need is to get your paperwork in order — if the security checks aren't solid, anyone could slip through the cracks and gain access they shouldn't have! This flaw stems from improper input validation, allowing an attacker who is already authenticated to exploit the system and elevate their permissions beyond intended limits.

What to do

This vulnerability could lead to an attacker gaining elevated privileges, potentially giving them control over sensitive data or the ability to manipulate server functions. This is no small threat; it could compromise the entire network's integrity! To mitigate this risk, immediately patch your Microsoft Exchange Server to the latest version. Regularly audit user permissions and ensure that robust input validation mechanisms are in place to prevent unauthorized privilege escalation. You've got this! Stay vigilant and patch up that server — you'll keep your network safe in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01020 · 63.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-12-09T23:16Z
Affected products (38)
ProductVersionsFixed in
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_serverall versions—
microsoft/exchange_server_subscription_edition< 15.02.2562.03515.02.2562.035
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Microsoft Exchange Server Elevation of Privilege Vulnerability
    cvelistv5