Loading story…
Microsoft issued guidance for CVE-2025-53786, a high-severity vulnerability in hybrid Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition deployments that can let an attacker with administrative access to an on-premises Exchange server escalate privileges into the connected cloud tenant. The issue stems from hybrid environments using a shared service principal tied to the Exchange Online application, creating a trust path that could enable unauthorized access to cloud data and services; Microsoft said it had not observed active exploitation but warned abuse would be difficult to detect.
The company has been moving customers away from that shared identity model under its Secure Future Initiative, releasing April 2025 Hotfix Updates to support migration to a dedicated Exchange hybrid application in Microsoft Entra ID. Organizations that rely on hybrid "rich coexistence" features such as Free/Busy, MailTips, and profile photo sharing must complete the dedicated-app migration before October 2025, when Exchange Online will stop allowing the shared service principal approach, and later transition hybrid calls from EWS to Microsoft Graph permissions before October 2026 as Exchange Online retires legacy EWS-based integration.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK reported that Microsoft had issued mitigation guidance for CVE-2025-53786, a high-severity flaw affecting hybrid Exchange deployments that could let an attacker with on-premises administrative access escalate privileges into the connected cloud environment. The report also said Microsoft had not detected active exploitation at that time and noted the shared service principal model would be disabled on 2025-10-31.
Microsoft announced security-driven changes for Exchange hybrid deployments, including moving tenants from the shared Exchange Online service principal to a dedicated Exchange hybrid application in Entra ID. The change was described as starting with the April 2025 Hotfix Update as part of Microsoft's Secure Future Initiative.
Microsoft released April 2025 Hotfix Updates for Exchange Server 2016 and 2019. The updates added functionality and fixes, and Microsoft stated they did not include any new Exchange Server security updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcetechcommunity.microsoft.com
Open sourcetechcommunity.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed multiple vulnerabilities in on-premises **Exchange Server**, including **CVE-2021-31207** (security feature bypass), **CVE-2021-31209** (spoofing), and **CVE-2022-41040** (elevation of privilege). The issues affected Exchange deployments rather than **Exchange Online**, extending a pattern of high-impact weaknesses in the mail platform that could undermine trust boundaries, enable impersonation, and weaken built-in protections. Among them, **CVE-2022-41040** was rated **Critical** with a **CVSS 3.1 score of 8.8**, and Microsoft said exploitation had been detected in the wild before public disclosure. The flaw required an authenticated attacker with low privileges and no user interaction, and successful exploitation could allow the attacker to run **PowerShell** as **`SYSTEM`**. Microsoft later released security updates and directed Exchange Server customers to apply mitigations and patches for the reported zero-day issues.
Jun 29, 2026
Microsoft has disclosed multiple **elevation of privilege** vulnerabilities affecting **Microsoft Exchange Server**, including `CVE-2021-34470`, `CVE-2021-41348`, `CVE-2022-41123`, and `CVE-2025-64666`, indicating a recurring security issue in the on-premises mail platform across several release cycles. The advisories show Exchange continued to receive fixes for privilege-escalation weaknesses over multiple years, with Microsoft publishing separate Security Update Guide entries as new flaws were identified. Among the listed issues, Microsoft provided the most detail for `CVE-2021-34470`, rating it **Important** with a **CVSS 3.0 score of 8.0** and describing it as requiring access from a logically adjacent network. Microsoft said the flaw required a **schema change** and was fixed for **Exchange Server 2019** and **Exchange Server 2016** in cumulative updates released on June 29, 2021; at initial publication, the company said it was **not publicly disclosed**, **not exploited**, and **less likely to be exploited**. A separate Microsoft advisory in the same reference set, `CVE-2026-26128`, affects the **Windows SMB Server** rather than Exchange and also involves elevation of privilege.
Jun 29, 2026
Microsoft disclosed **CVE-2026-42897**, a high-severity spoofing vulnerability in on-premises **Microsoft Exchange Server** that is being actively exploited in the wild. The flaw stems from improper neutralization of input during web page generation and can be triggered when a user opens a specially crafted email in **Outlook Web Access**, leading to cross-site scripting and arbitrary JavaScript execution in the victim’s browser context. Affected products include **Exchange Server 2016**, **Exchange Server 2019**, and **Exchange Server Subscription Edition**; **Exchange Online** is not affected. Microsoft has not yet released a permanent patch for `CVE-2026-42897`, but said it is automatically deploying a temporary mitigation through the **Exchange Emergency Mitigation Service**, which applies a URL rewrite configuration and is enabled by default. For air-gapped or disconnected environments, the company directed administrators to use the **Exchange on-premises Mitigation Tool**, while noting a cosmetic issue may affect mitigation status reporting. Microsoft also published the vulnerability in its Security Update Guide alongside other advisories, including **CVE-2026-41615** for Microsoft Authenticator.
Jun 29, 2026