What is the CVSS score of CVE-2025-59248?

CVE-2025-59248 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.9%.

Which versions of Microsoft Exchange Server are affected by CVE-2025-59248?

Microsoft Exchange Server 2016 and Subscription Edition contain an unauthenticated spoofing vulnerability (CVE-2025-59248, CVSS 7.5) that allows remote attackers to impersonate trusted entities,…

How to fix or mitigate CVE-2025-59248?

Within 24 hours: Audit Exchange server configurations and enable strict email authentication (SPF, DKIM, DMARC) to create compensating controls for spoofing detection. Within 7 days: Deploy email gateway rules to flag suspicious sender impersonation and configure Exchange intrusion detection to alert on authentication anomalies. Within 30 days: Subscribe to Microsoft security advisories for CVE-2025-59248 patch availability; evaluate temporary network segmentation or restricted Exchange connectivity as interim containment if patch remains unavailable.

Microsoft Exchange Server CVE-2025-59248

HIGH

Improper Input Validation (CWE-20)

2025-10-14 secure@microsoft.com

Microsoft Authentication Bypass Exchange Server Exchange Server Subscription Edition

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-reachable Exchange service, unauthenticated and no user interaction per description and tags; spoofing yields high integrity impact only, with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 19:30 vuln.today

CVE Published

Oct 14, 2025 - 17:16 nvd

HIGH 7.5

DescriptionNVD

Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Spoofing in Microsoft Exchange Server (including 2016 cumulative updates and Subscription Edition) allows remote unauthenticated attackers to impersonate trusted entities over the network due to improper input validation. The flaw carries a CVSS 7.5 with integrity-only impact, and no public exploit identified at time of analysis. Defenders should treat it as a credible spoofing/authentication-bypass primitive that may be chained with downstream phishing or follow-on Exchange attacks.

Technical ContextAI

Microsoft Exchange Server is the on-premises messaging and collaboration platform providing SMTP, MAPI/HTTP, EWS, OWA, and Autodiscover services. The root cause is CWE-20 (Improper Input Validation): a server-side component fails to properly validate attacker-supplied input, enabling forged data to be accepted as legitimate. Tagged as an Authentication Bypass / Spoofing class issue, this typically manifests in Exchange as a trust-boundary failure - for example mishandling of identity, header, or token data - allowing one party's content or identity to be presented as another's. CPE data confirms Exchange Server 2016 across multiple cumulative updates (CU1 through CU17 enumerated) is in scope, and the advisory tags indicate Exchange Server Subscription Edition is also affected.

RemediationAI

Apply the Microsoft security update for CVE-2025-59248 as published in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59248; exact fix build numbers are listed there per Exchange Server 2016 cumulative update and for Exchange Server Subscription Edition, and administrators should install the security update matching their current CU level (Patch available per vendor advisory). Until patched, restrict external exposure of Exchange surfaces that are not strictly required - for example limiting OWA, EWS, and Autodiscover access to known IP ranges or VPN-only via the perimeter or Exchange Front End, accepting the trade-off of breaking external mobile and roaming Outlook clients. Enforce strict SPF/DKIM/DMARC alignment and TLS on inbound SMTP to reduce downstream impact of spoofed messages, and monitor IIS, transport, and OWA logs for anomalous authentication and identity-mismatch events; note that none of these workarounds substitute for the vendor update.