What is the CVSS score of CVE-2025-53782?

CVE-2025-53782 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Exchange Server are affected by CVE-2025-53782?

Microsoft Exchange Server 2016 and Subscription Edition contain a local privilege escalation vulnerability (CVE-2025-53782) that allows authenticated users with low system privileges to gain complete…

How to fix or mitigate CVE-2025-53782?

Within 24 hours: Inventory all Exchange 2016 and Subscription Edition systems; restrict local interactive access to only essential administrators; review and tighten local user account policies. Within 7 days: Enable Windows Event Log auditing for privilege escalation (Event IDs 4688, 4689, 4719); deploy endpoint detection and response (EDR) tools; implement privileged access management (PAM) for local administrator credentials. Within 30 days: Monitor Microsoft MSRC advisories continuously for patch release; prepare expedited patch testing and deployment procedures; prioritize patching of production Exchange servers immediately upon vendor release.

Microsoft Exchange Server CVE-2025-53782

HIGH

Incorrect Implementation of Authentication Algorithm (CWE-303)

2025-10-14 secure@microsoft.com

Microsoft Authentication Bypass Exchange Server Exchange Server Subscription Edition

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local Exchange host access required (AV:L), low-priv authenticated user suffices (PR:L), no user interaction, and flawed auth grants full Exchange control yielding C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 19:30 vuln.today

CVE Published

Oct 14, 2025 - 17:15 nvd

HIGH 7.8

DescriptionNVD

Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Exchange Server 2016 (and Subscription Edition) stems from an incorrect implementation of an authentication algorithm (CWE-303), allowing a low-privileged local user to gain high-impact control over confidentiality, integrity, and availability of the mail platform. The flaw was reported by Microsoft (MSRC) and carries a CVSS 3.1 base of 7.8 (AV:L/AC:L/PR:L/UI:N). At time of analysis, no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but exploitation by an authenticated insider on an Exchange host would yield full server compromise.

Technical ContextAI

Microsoft Exchange Server is the on-premises messaging and collaboration platform that handles mailbox storage, transport, and authentication for Outlook, OWA, and ActiveSync clients. CWE-303 (Incorrect Implementation of Authentication Algorithm) means the server's authentication logic deviates from the specified or intended algorithm - typically by mishandling tokens, comparing credentials incorrectly, or skipping a verification step - letting a caller assume an identity or role they have not legitimately authenticated as. The CPE list pins the affected build line to Exchange Server 2016 across cumulative updates CU1 through CU17, and the tags add Exchange Server Subscription Edition, indicating the defective code path persists across the 2016 servicing branch and the modernized SE release. Because the CVSS vector is AV:L with PR:L, the bug is reachable by a local, low-privilege principal on the Exchange host (for example a constrained service account or a logged-on operator), not by a remote unauthenticated user against OWA.

RemediationAI

Patch available per vendor advisory - apply the Microsoft Exchange security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53782 to the affected Exchange Server 2016 cumulative updates (CU1-CU17) and Exchange Server Subscription Edition, prioritizing internet-exposed or multi-admin Exchange hosts. Because exact fix versions were not enumerated in the provided input, obtain the specific KB and CU build numbers directly from the MSRC page before scheduling deployment, and as standard Exchange practice run Setup.exe /PrepareSchema where the update requires it. As compensating controls until patching completes, restrict interactive and remote PowerShell logon to the Exchange servers to a minimal Tier-0/Exchange-admin group (trade-off: may interrupt third-party backup or monitoring agents that log on locally), audit and rotate any shared service-account credentials with local rights on Exchange hosts (trade-off: requires coordinated app restarts), and tighten Exchange RBAC so unprivileged mailbox principals do not hold any management role assignments. Generic 'defense in depth' is not sufficient given CWE-303's algorithmic nature - there is no reliable configuration toggle that disables the flawed authentication path.