Exchange Hybrid CVE-2025-53786: On-Prem to Cloud Escalation
Not known to be exploited and requires on-prem Exchange admin first, but it turns any on-prem compromise into a quiet cloud takeover, so verify the dedicated hybrid app is in place and the old shared credential is gone.
Must act: Organizations that run, or ever ran, Exchange hybrid or OAuth between on-premises Exchange Server and Exchange Online.
Can relax: Cloud-only Exchange Online tenants that never configured hybrid, and on-prem-only Exchange shops with no Exchange Online connection.
- Run Microsoft's Exchange Server Health Checker on every on-prem server to inventory CU and hotfix levels.
- Install the April 2025 Hotfix Update or later on hybrid servers; disconnect servers that cannot take it.
- Deploy the dedicated Exchange hybrid app in Entra ID (ConfigureExchangeHybridApplication.ps1 or the Hybrid Configuration Wizard).