What is the CVSS score of CVE-2025-59249?

CVE-2025-59249 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Microsoft Exchange Server are affected by CVE-2025-59249?

Microsoft Exchange Server 2016 and Subscription Edition contain a privilege escalation vulnerability (CVE-2025-59249, CVSS 8.8) that allows authenticated network attackers to gain administrative…

How to fix or mitigate CVE-2025-59249?

Within 24 hours: Inventory all Exchange Server 2016 and Subscription Edition instances across your infrastructure. Within 7 days: Implement network access controls limiting Exchange connectivity to authorized administrators, enforce multi-factor authentication on all administrative accounts, and enable logging for privilege escalation attempts. Within 30 days: Monitor vendor security advisories daily for CVE-2025-59249 patch release; maintain compensating controls until patch is applied.

Microsoft Exchange Server CVE-2025-59249

HIGH

Weak Authentication (CWE-1390)

2025-10-14 secure@microsoft.com

Microsoft Information Disclosure Exchange Server Exchange Server Subscription Edition

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable Exchange endpoint (AV:N), reliable exploitation once authenticated (AC:L), requires a standard mailbox account (PR:L), no victim interaction (UI:N), and weak-auth EoP yields full CIA impact within Exchange's authorization scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 19:31 vuln.today

CVE Published

Oct 14, 2025 - 17:16 cve.org

HIGH 8.8

DescriptionCVE.org

Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Exchange Server (including 2016 cumulative updates and Subscription Edition) allows an authenticated network attacker to elevate privileges due to weak authentication mechanisms (CWE-1390). With a CVSS score of 8.8 and full confidentiality, integrity, and availability impact, this represents a significant risk to mail infrastructure, though no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in Microsoft Exchange Server, an enterprise messaging platform handling email, calendar, and collaboration services. The root cause is classified under CWE-1390 (Weak Authentication), a category covering authentication mechanisms that fail to adequately verify identity - typically due to insufficient credential validation, weak token handling, or flawed protocol implementation. CPE data confirms Exchange Server 2016 across cumulative updates 1 through 17 is affected, and tags reference the Subscription Edition. Exchange's complex authentication stack (including NTLM, Kerberos, and OAuth across multiple service endpoints like EWS, MAPI, and PowerShell) historically presents a broad attack surface where weak authentication flaws can permit token relay, impersonation, or privilege boundary crossing.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59249 for the affected Exchange Server 2016 cumulative updates and Subscription Edition deployments; consult the MSRC update guide for the exact KB article and build number matching your CU level, as Microsoft typically ships Exchange fixes as cumulative security updates. Because the prerequisite is an authenticated low-privilege mailbox user, compensating controls include enforcing strong multi-factor authentication on all mailbox accounts, restricting Exchange administrative endpoints (EAC, PowerShell, EWS) to management networks via firewall ACLs or reverse proxy filtering, rotating service account passwords, and auditing for anomalous authentication patterns; note that endpoint restrictions may break legitimate remote mailbox access for mobile and external users, so coordinate with messaging operations before applying.