Microsoft and CISA Warn of Critical Exchange Server Flaw that Could Lead to Domain Takeover

Microsoft and the US Cybersecurity and Infrastructure Security Agency (CISA) have issued a warning about a critical vulnerability in Exchange Server hybrid deployments, tracked as CVE-2025-53786. This flaw, which has not yet been exploited in the wild, can potentially allow attackers to escalate privileges from on-premises Exchange servers to the cloud environment, leading to a total domain compromise. Microsoft has emphasized that exploitation is ‘more likely’ due to the nature of the vulnerability. The bug arises from the way hybrid Exchange deployments authenticate users between on-premises servers and Exchange Online using shared identities. This flaw could allow attackers with administrative access to an on-premises server to gain control of the entire cloud-connected system, without leaving easily traceable evidence. To mitigate the risk, organizations using Exchange hybrid setups are urged to apply a security hotfix released in April 2025 and follow the configuration steps outlined by Microsoft. CISA has mandated that all federal agencies patch this vulnerability by August 11, 2025. This issue follows a string of previous Exchange security breaches, particularly involving state-sponsored hacking groups, and highlights ongoing vulnerabilities in Microsoft’s cloud services.