29,000 Microsoft Exchange servers remain unpatched against critical flaw

CVE-2025-53786 could let attackers seize hybrid cloud and on-premises domains

More than 29,000 Microsoft Exchange servers exposed to the internet are still vulnerable to a high-severity security flaw that could allow attackers to seize complete control over an organisation's domain, security researchers have warned.

According to recent scans from the threat monitoring platform Shadowserver, 29,098 Exchange servers worldwide remain unpatched against CVE-2025-53786, a vulnerability capable of enabling lateral movement in hybrid Microsoft cloud environments.

The flaw lets attackers with administrative access to on-premises Exchange Server instances escalate privileges in connected cloud environments by forging or manipulating trusted tokens or API calls – methods that leave few detectable traces, making exploitation difficult to spot.

The distribution of unpatched systems is heavily concentrated in certain regions, with more than 7,200 vulnerable IP addresses located in the US, over 6,700 in Germany and more than 2,500 in Russia.

CVE-2025-53786 affects Microsoft Exchange Server 2016, Exchange Server 2019 and the newer Microsoft Exchange Server Subscription Edition, used in hybrid configurations.

Microsoft first disclosed the flaw last week, although it had already issued a hotfix back in April as part of its Secure Future Initiative (SFI).

The update introduced a new hybrid architecture that replaces the insecure shared identity system between on-premises Exchange and Exchange Online with a dedicated hybrid app.

“As a part of our Secure Future Initiative (SFI) we are making changes to improve the security of your Exchange Hybrid configuration. One of the steps toward this goal is to separate the identities of Exchange Server and Exchange Online by creating a dedicated Exchange hybrid application in Microsoft Entra ID,” the company said.

While Microsoft says it has found no evidence of active exploitation so far, the flaw is tagged as "exploitation more likely," with Redmond cautioning that reliable exploit code could be developed and weaponised.

CISA orders immediate federal action

In response to the risk, the US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 25-02 last week, ordering all Federal Civilian Executive Branch (FCEB) agencies to take urgent mitigation steps.

FCEB agencies are non-military entities within the US executive branch, encompassing departments such as Homeland Security, Treasury, Energy, and Health and Human Services.

Under the directive, agencies must:

1. Inventory their Exchange environments using Microsoft's Health Checker script.
2. Disconnect from the internet any public-facing Exchange servers no longer supported by the April 2025 hotfix, including end-of-life or end-of-service versions.
3. Update all remaining servers to the latest cumulative updates – CU14 or CU15 for Exchange 2019, CU23 for Exchange 2016 – and apply the April 2025 hotfix.

In a separate advisory issued Thursday, CISA warned that failure to patch CVE-2025-53786 could result in "a hybrid cloud and on-premises total domain compromise."

Although non-government organisations are not legally bound by the directive, CISA strongly urged them to follow the same security measures.

“While Microsoft has stated there is no observed exploitation as of the time of this alert's publication, CISA strongly urges organisations to implement Microsoft's Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability guidance… or risk leaving the organisation vulnerable to a hybrid cloud and on-premises total domain compromise,” the agency noted.