CyberzSOC

The vulnerability tracked as CVE-2025-53786 allows an attacker with administrative access to an on-premises Exchange Server to escalate privileges into the connected Exchange Online environment. The vulnerability can impact the confidentiality, integrity, and availability of affected systems. An attacker with admin privileges on an on-premise Exchange server can potentially forge or manipulate trusted tokens or API calls that the cloud side will accept as legitimate. This technique allows the attackers to spread laterally from the local network into the organisation’s cloud environment, potentially compromising the organisation’s entire active directory and infrastructure [6]. The vulnerability affects the following Microsoft Exchange Servers in Hybrid Exchange Deployments: It is strongly recommended to apply the follow the vendor guidance [1]: but no longer use it), review Microsoft’s Service Principal Clean-Up Mode [4] for guidance on resetting the service principal’s keyCredentials .