Microsoft Exchange Server CVE-2025-64666

The attacker must hold valid authenticated credentials to Exchange (CVSS PR:L, consistent with a standard mailbox user or service account) and must be able to reach the Exchange server over the network (AV:N), typically via HTTPS-exposed Exchange web services. Exploitation is further gated by High attack complexity (AC:L not met - AC:H), implying special conditions outside the attacker's control such as a race condition, specific server configuration, or a particular input state are required for the improper-input-validation flaw to escalate privileges; no user interaction is required (UI:N). Limiting factors that reduce realistic risk: organizations enforcing MFA and conditional access on all Exchange accounts substantially raise the bar for obtaining the required low-privilege foothold, and internal-only Exchange deployments are not reachable by external attackers.

The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-reachable issue with full CIA impact but tempered by High attack complexity and a Low-privilege precondition, meaning the attacker must already hold a valid (typically mailbox-level) Exchange account and overcome non-trivial exploitation conditions such as race windows, specific server state, or crafted protocol sequences. EPSS and CISA KEV data were not provided in the input, so probabilistic exploitation likelihood and confirmed in-the-wild use cannot be asserted here. Historically, Exchange privilege-escalation bugs are aggressively weaponized once details surface (e.g., ProxyShell/ProxyNotShell chains), so the realistic priority is high for any internet-exposed Exchange deployment despite AC:H, but defenders should not treat this as a remote-unauthenticated RCE - the PR:L requirement materially limits opportunistic attacks.

An attacker who has obtained or phished valid credentials for any low-privileged Exchange mailbox account reaches the Exchange server over the network and sends a crafted sequence of requests containing malformed input that the server fails to validate, causing the request to be processed in a higher-privilege context and granting the attacker elevated rights such as mailbox-wide read/write or administrative capability. No public exploit identified at time of analysis, but the AC:H rating implies a working exploit would likely require precise timing or environmental conditions.