CISA and Microsoft warn of an Exchange Server Hybrid flaw enabling attackers to compromise the Cloud instance

CISA and Microsoft are warning of a security vulnerability in Exchange Server hybrid deployments that allows authenticated attackers with administrative access to on-premises Microsoft Exchange servers to escalate privileges within connected cloud environments, potentially compromising the identity integrity of an organization's Exchange Online service.

The vulnerability is  tracked as CVE-2025-53786 (CVSS score 8.0) and stems from Exchange Server and Exchange Online sharing the same service principal in hybrid configurations. This creates a dangerous trust relationship that attackers can exploit Successful exploitation allows attackers to access the organization's connected cloud environment without leaving easily detectable and auditable traces.

Affected Versions:

• Microsoft Exchange Server 2016 (all versions in hybrid deployments)
• Microsoft Exchange Server 2019 (all versions in hybrid deployments)
• Microsoft Exchange Server Subscription Edition (all versions in hybrid deployments)

Versions that are not affected:

• Standalone Exchange Server deployments (not configured for hybrid)
• Exchange Server deployments that have implemented the April 2025 hotfix updates and dedicated hybrid app configuration
• Organizations that have completed service principal cleanup and implemented proper security boundaries

Although the prerequisite for exploitation is high -  to have administrative privileges - they are not impossible to obtain via infostealers, other malware or phishing. This flaw escalates the risk towards the rest of the enterprise in the cloud. 

CISA strongly urges organizations to implement Microsoft's Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability guidance:

1. Review Microsoft’s guidance Exchange Server Security Changes for Hybrid Deployments
2. Install Microsoft’s April 2025 Exchange Server Hotfix Updates on the on-premise Exchange server and follow Microsoft’s configuration instructions Deploy dedicated Exchange hybrid app
3. For organizations using Exchange hybrid (or have previously configured Exchange hybrid but no longer use it), review Microsoft's Service Principal Clean-Up Mode for guidance on resetting the service principal’s keyCredentials. 
4. Run the Microsoft Exchange Health Checker to determine if further steps are required.