What is the CVSS score of CVE-2025-64666?

CVE-2025-64666 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Microsoft Exchange Server are affected by CVE-2025-64666?

A privilege escalation vulnerability in Microsoft Exchange Server 2016 and Subscription Edition allows authenticated network users to gain elevated system access, creating risk to email…

How to fix or mitigate CVE-2025-64666?

Within 24 hours: Conduct inventory of all Microsoft Exchange Server 2016 and Subscription Edition deployments to determine exposure scope. Within 7 days: Implement network access controls restricting Exchange Server administrative interfaces to trusted networks only, and enable enhanced logging for authentication attempts and privilege escalation attempts. Within 30 days: Monitor Microsoft security advisories for CVE-2025-64666 patch release; evaluate upgrade timeline to newer supported Exchange Server versions as interim mitigation strategy.

Microsoft Exchange Server CVE-2025-64666

HIGH

Improper Input Validation (CWE-20)

2025-12-09 secure@microsoft.com

Microsoft Information Disclosure Exchange Server Exchange Server Subscription Edition

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable Exchange endpoint (AV:N), requires valid low-privilege mailbox account (PR:L), no user interaction (UI:N), high complexity due to input-validation race/state conditions (AC:H), full CIA impact via privilege elevation on the Exchange server.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 19:31 vuln.today

CVE Published

Dec 09, 2025 - 18:16 nvd

HIGH 7.5

DescriptionNVD

Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Exchange Server 2016 (and Subscription Edition per vendor tagging) allows an authenticated attacker on the network to elevate privileges through improper input validation (CWE-20). The flaw carries a CVSS 7.5 score with high impact to confidentiality, integrity, and availability, though attack complexity is rated High. No public exploit identified at time of analysis.

Technical ContextAI

Microsoft Exchange Server is an enterprise mail and collaboration platform that exposes a large attack surface through MAPI/HTTP, EWS, OWA, ECP, and PowerShell remoting endpoints. The root cause is CWE-20 (Improper Input Validation), meaning a component within Exchange fails to adequately validate attacker-supplied input received over the network, and that improperly validated data ultimately drives a privilege decision or operation executed in a higher-privilege context. CPE data confirms Exchange Server 2016 and its cumulative updates 1 through 17 are enumerated as affected, and the vendor tagging additionally references Exchange Server Subscription Edition, suggesting the vulnerable code path is shared across modern Exchange branches.

RemediationAI

Patch available per vendor advisory: apply the security updates published by Microsoft for CVE-2025-64666 as listed in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64666, ensuring all Exchange 2016 servers are brought to the latest cumulative update plus the corresponding security update, and that Exchange Server Subscription Edition deployments receive the matching SU. Until patched, reduce exposure by restricting access to Exchange management endpoints (ECP, PowerShell remoting, EWS) to administrative networks only via firewall or reverse-proxy ACLs, enforce strong authentication and MFA on all mailbox accounts to raise the bar against the PR:L precondition, and monitor Exchange and IIS logs for anomalous authenticated requests to administrative URLs; note that restricting ECP/EWS can break legitimate Outlook on the Web administration and third-party integrations, so stage changes carefully.