Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-25006 (GCVE-0-2025-25006)
Vulnerability from cvelistv5 – Published: 2025-08-12 17:09 – Updated: 2026-02-13 18:54
VLAI
EPSS
Title
Microsoft Exchange Server Spoofing Vulnerability
Summary
Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-167 - Improper Handling of Additional Special Element
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 23 |
Affected:
15.01.0.0 , < 15.01.2507.058
(custom)
|
|
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 14 |
Affected:
15.02.0.0 , < 15.02.1544.033
(custom)
|
|
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 15 |
Affected:
15.02.0.0 , < 15.02.1748.036
(custom)
|
|
| Microsoft | Microsoft Exchange Server Subscription Edition RTM |
Affected:
15.02.0.0 , < 15.02.2562.020
(custom)
|
Date Public
2025-08-12 07:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-25006",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-12T19:07:17.893409Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-12T20:45:30.163Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft Exchange Server 2016 Cumulative Update 23",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.01.2507.058",
"status": "affected",
"version": "15.01.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft Exchange Server 2019 Cumulative Update 14",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.02.1544.033",
"status": "affected",
"version": "15.02.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft Exchange Server 2019 Cumulative Update 15",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.02.1748.036",
"status": "affected",
"version": "15.02.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft Exchange Server Subscription Edition RTM",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.02.2562.020",
"status": "affected",
"version": "15.02.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*",
"versionEndExcluding": "15.02.1748.036",
"versionStartIncluding": "15.02.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*",
"versionEndExcluding": "15.01.2507.058",
"versionStartIncluding": "15.01.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*",
"versionEndExcluding": "15.02.1544.033",
"versionStartIncluding": "15.02.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*",
"versionEndExcluding": "15.02.2562.020",
"versionStartIncluding": "15.02.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2025-08-12T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-167",
"description": "CWE-167: Improper Handling of Additional Special Element",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-13T18:54:10.423Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Exchange Server Spoofing Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006"
}
],
"title": "Microsoft Exchange Server Spoofing Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2025-25006",
"datePublished": "2025-08-12T17:09:53.262Z",
"dateReserved": "2025-01-30T15:14:20.994Z",
"dateUpdated": "2026-02-13T18:54:10.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-25006",
"date": "2026-06-10",
"epss": "0.03245",
"percentile": "0.87401"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-25006\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2025-08-12T18:15:27.830\",\"lastModified\":\"2025-09-03T14:51:39.180\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.\"},{\"lang\":\"es\",\"value\":\"El manejo inadecuado de un elemento especial adicional en Microsoft Exchange Server permite que un atacante no autorizado realice suplantaci\u00f3n de identidad a trav\u00e9s de una red.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-167\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:*:*:*:*:subscription:*:*:*\",\"versionEndExcluding\":\"15.02.2562.020\",\"matchCriteriaId\":\"2C8A8803-ED8E-437F-B7FB-7E2F9A64A235\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"8039FBA1-73D4-4FF2-B183-0DCC961CBFF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:*\",\"matchCriteriaId\":\"56728785-188C-470A-9692-E6C7235109CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*\",\"matchCriteriaId\":\"63E362CB-CF75-4B7E-A4B1-D6D84AFCBB68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BE04790-85A2-4078-88CE-1787BC5172E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*\",\"matchCriteriaId\":\"CCF101BE-27FD-4E2D-A694-C606BD3D1ED7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DF5BDB5-205D-4B64-A49A-0152AFCF4A13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*\",\"matchCriteriaId\":\"55284CF7-0D04-4216-83FE-4B1F9CA94207\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA2CE223-AA49-49E6-AC32-59270EFF55AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*\",\"matchCriteriaId\":\"4830D6A9-AF74-480C-8F69-8648CD619980\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*\",\"matchCriteriaId\":\"079E1E3F-FF25-4B0D-AC98-191D6455A014\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*\",\"matchCriteriaId\":\"29805EC7-6403-44B9-91EC-109C087E98EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*\",\"matchCriteriaId\":\"28FCA0E8-7D27-4746-9731-91B834CA3E64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:*\",\"matchCriteriaId\":\"996163E7-6F3F-4D3B-AEA4-62A7F7E1F54D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*\",\"matchCriteriaId\":\"19C1EE0C-B8DD-4B91-BE4B-1C42D72FB718\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*\",\"matchCriteriaId\":\"3BE427A4-B0C2-4064-8234-29426325C348\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_3:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE401B0A-DDE4-4A36-8E27-6DB14E094BE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_4:*:*:*:*:*:*\",\"matchCriteriaId\":\"450319C4-7C8F-43B7-B7F8-80DA4F1F2817\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_5:*:*:*:*:*:*\",\"matchCriteriaId\":\"23015889-48AF-40A5-862F-290E73A54E77\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_6:*:*:*:*:*:*\",\"matchCriteriaId\":\"4FC34516-D7E7-4AD9-9B45-5474831548E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:*\",\"matchCriteriaId\":\"5211792E-5292-41C0-B7E9-8AA63EC606EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*\",\"matchCriteriaId\":\"075E907F-AF2F-4C31-86C7-51972BE412A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*\",\"matchCriteriaId\":\"69AF19DC-3D65-49A8-A85F-511085CDF27B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"40D8A6DB-9225-4A3F-AD76-192F6CCCF002\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*\",\"matchCriteriaId\":\"051DE6C4-7456-4C42-BC51-253208AADB4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4185347-EEDD-4239-9AB3-410E2EC89D2A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*\",\"matchCriteriaId\":\"435343A4-BF10-461A-ABF2-D511A5FBDA75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*\",\"matchCriteriaId\":\"B23C8E3E-5243-4DA6-B9AA-F6053084B55E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:*\",\"matchCriteriaId\":\"583745C7-B802-4CBE-BD88-B5B9AF9B5371\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE320413-D2C9-4B28-89BF-361B44A3F0FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*\",\"matchCriteriaId\":\"104F96DC-E280-4E0A-8586-B043B55888C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*\",\"matchCriteriaId\":\"73B3B3FE-7E85-4B86-A983-2C410FFEF4B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A9FB275-7F17-48B2-B528-BE89309D2AF5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4AB3C25-CEA8-4D66-AEE4-953C8B17911A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*\",\"matchCriteriaId\":\"36CE5C6D-9A04-41F5-AE7C-265779833649\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*\",\"matchCriteriaId\":\"44ECF39A-1DE1-4870-A494-06A53494338D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*\",\"matchCriteriaId\":\"71CDF29B-116B-4DE2-AFD0-B62477FF0AEB\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-25006\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-08-12T19:07:17.893409Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-08-12T19:07:20.021Z\"}}], \"cna\": {\"title\": \"Microsoft Exchange Server Spoofing Vulnerability\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Microsoft\", \"product\": \"Microsoft Exchange Server 2016 Cumulative Update 23\", \"versions\": [{\"status\": \"affected\", \"version\": \"15.01.0.0\", \"lessThan\": \"15.01.2507.058\", \"versionType\": \"custom\"}], \"platforms\": [\"x64-based Systems\"]}, {\"vendor\": \"Microsoft\", \"product\": \"Microsoft Exchange Server 2019 Cumulative Update 14\", \"versions\": [{\"status\": \"affected\", \"version\": \"15.02.0.0\", \"lessThan\": \"15.02.1544.033\", \"versionType\": \"custom\"}], \"platforms\": [\"x64-based Systems\"]}, {\"vendor\": \"Microsoft\", \"product\": \"Microsoft Exchange Server 2019 Cumulative Update 15\", \"versions\": [{\"status\": \"affected\", \"version\": \"15.02.0.0\", \"lessThan\": \"15.02.1748.036\", \"versionType\": \"custom\"}], \"platforms\": [\"x64-based Systems\"]}, {\"vendor\": \"Microsoft\", \"product\": \"Microsoft Exchange Server Subscription Edition RTM\", \"versions\": [{\"status\": \"affected\", \"version\": \"15.02.0.0\", \"lessThan\": \"15.02.2562.020\", \"versionType\": \"custom\"}], \"platforms\": [\"x64-based Systems\"]}], \"datePublic\": \"2025-08-12T07:00:00.000Z\", \"references\": [{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006\", \"name\": \"Microsoft Exchange Server Spoofing Vulnerability\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-167\", \"description\": \"CWE-167: Improper Handling of Additional Special Element\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"15.02.1748.036\", \"versionStartIncluding\": \"15.02.0.0\"}, {\"criteria\": \"cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"15.01.2507.058\", \"versionStartIncluding\": \"15.01.0.0\"}, {\"criteria\": \"cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"15.02.1544.033\", \"versionStartIncluding\": \"15.02.0.0\"}, {\"criteria\": \"cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"15.02.2562.020\", \"versionStartIncluding\": \"15.02.0.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\", \"dateUpdated\": \"2026-02-13T18:54:10.423Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-25006\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-13T18:54:10.423Z\", \"dateReserved\": \"2025-01-30T15:14:20.994Z\", \"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"datePublished\": \"2025-08-12T17:09:53.262Z\", \"assignerShortName\": \"microsoft\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Title
Уязвимость почтового сервера Microsoft Exchange Server, связанная с неправильной обработкой дополнительного специального элемента, позволяющая нарушителю проводить спуфинг-атаки
Description
Уязвимость почтового сервера Microsoft Exchange Server связана с неправильной обработкой дополнительного специального элемента. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, проводить спуфинг-атаки
Severity
Vendor
Microsoft Corp
Software Name
Microsoft Exchange Server
Software Version
2019 Cumulative Update 14 (Microsoft Exchange Server), 2016 Cumulative Update 23 (Microsoft Exchange Server), 2019 Cumulative Update 15 (Microsoft Exchange Server), Subscription Edition RTM (Microsoft Exchange Server)
Possible Mitigations
Использование рекомендаций:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006
Reference
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006
CWE
CWE-167
{
"CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Microsoft Corp",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "2019 Cumulative Update 14 (Microsoft Exchange Server), 2016 Cumulative Update 23 (Microsoft Exchange Server), 2019 Cumulative Update 15 (Microsoft Exchange Server), Subscription Edition RTM (Microsoft Exchange Server)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "12.08.2025",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "22.08.2025",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "22.08.2025",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-10168",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-25006",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Microsoft Exchange Server",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange Server, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0441\u043f\u0443\u0444\u0438\u043d\u0433-\u0430\u0442\u0430\u043a\u0438",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430 (CWE-167)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange Server \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0441\u043f\u0443\u0444\u0438\u043d\u0433-\u0430\u0442\u0430\u043a\u0438",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u043e\u043a\u0430\u043c\u0438 \u0438 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-167",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,3)"
}
CERTFR-2025-AVI-0689
Vulnerability from certfr_avis - Published: 2025-08-13 - Updated: 2025-08-13
De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) versions antérieures à 13.0.6465.1 | ||
| Microsoft | N/A | Microsoft Teams pour Android versions antérieures à 1416/1.0.0.2025102802 | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.1 antérieures à 9.1.38.10 | ||
| Microsoft | N/A | Microsoft SharePoint Server Subscription Edition versions antérieures à 16.0.18526.20518 | ||
| Microsoft | N/A | Microsoft SharePoint Enterprise Server 2016 versions antérieures à 16.0.5513.1002 | ||
| Microsoft | N/A | Teams Phones versions antérieures à 1449/1.0.94.2025168802 | ||
| Microsoft | N/A | Teams Panels versions antérieures à 1449/1.0.97.2025102203 | ||
| Microsoft | N/A | Web Deploy 4.0 versions antérieures à 10.0.2001 | ||
| Microsoft | N/A | Microsoft Teams pour iOS versions antérieures à 7.10.1 (100772025102901) | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 31) versions antérieures à 14.0.3500.1 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) versions antérieures à 15.0.2140.1 | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) versions antérieures à 14.0.2080.1 | ||
| Microsoft | N/A | Teams pour D365 Remote Assist HoloLens versions antérieures à 316.2505.28001 | ||
| Microsoft | N/A | Microsoft SharePoint Server 2019 versions antérieures à 16.0.10417.20041 | ||
| Microsoft | N/A | Microsoft Exchange Server Subscription Edition RTM versions antérieures à 15.02.2562.020 | ||
| Microsoft | N/A | Teams pour D365 Guides Hololens versions antérieures à 907.2505.29001.0 | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (GDR) versions antérieures à 16.0.1145.1 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.14 antérieures à 17.14.12 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 32) versions antérieures à 15.0.4440.1 | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 23 versions antérieures à 15.01.2507.058 | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 14 versions antérieures à 15.02.1544.033 | ||
| Microsoft | N/A | Microsoft Teams pour Desktop versions antérieures à 25122.1415.3698.6812 | ||
| Microsoft | N/A | Microsoft Teams pour Mac versions antérieures à 25122.1207.3700.1444 | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (CU 20) versions antérieures à 16.0.4210.1 | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.1 antérieures à 9.1.39 | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 15 versions antérieures à 15.02.1748.036 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR) versions ant\u00e9rieures \u00e0 13.0.6465.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Teams pour Android versions ant\u00e9rieures \u00e0 1416/1.0.0.2025102802",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.1 ant\u00e9rieures \u00e0 9.1.38.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Server Subscription Edition versions ant\u00e9rieures \u00e0 16.0.18526.20518",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Enterprise Server 2016 versions ant\u00e9rieures \u00e0 16.0.5513.1002",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Teams Phones versions ant\u00e9rieures \u00e0 1449/1.0.94.2025168802",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Teams Panels versions ant\u00e9rieures \u00e0 1449/1.0.97.2025102203",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Web Deploy 4.0 versions ant\u00e9rieures \u00e0 10.0.2001",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Teams pour iOS versions ant\u00e9rieures \u00e0 7.10.1 (100772025102901)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 31) versions ant\u00e9rieures \u00e0 14.0.3500.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR) versions ant\u00e9rieures \u00e0 15.0.2140.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR) versions ant\u00e9rieures \u00e0 14.0.2080.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Teams pour D365 Remote Assist HoloLens versions ant\u00e9rieures \u00e0 316.2505.28001",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Server 2019 versions ant\u00e9rieures \u00e0 16.0.10417.20041",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server Subscription Edition RTM versions ant\u00e9rieures \u00e0 15.02.2562.020",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Teams pour D365 Guides Hololens versions ant\u00e9rieures \u00e0 907.2505.29001.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (GDR) versions ant\u00e9rieures \u00e0 16.0.1145.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.14 ant\u00e9rieures \u00e0 17.14.12",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 32) versions ant\u00e9rieures \u00e0 15.0.4440.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 23 versions ant\u00e9rieures \u00e0 15.01.2507.058",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 14 versions ant\u00e9rieures \u00e0 15.02.1544.033",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Teams pour Desktop versions ant\u00e9rieures \u00e0 25122.1415.3698.6812",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Teams pour Mac versions ant\u00e9rieures \u00e0 25122.1207.3700.1444",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (CU 20) versions ant\u00e9rieures \u00e0 16.0.4210.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.1 ant\u00e9rieures \u00e0 9.1.39",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 15 versions ant\u00e9rieures \u00e0 15.02.1748.036",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-53760",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53760"
},
{
"name": "CVE-2025-53772",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53772"
},
{
"name": "CVE-2025-53736",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53736"
},
{
"name": "CVE-2025-25005",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25005"
},
{
"name": "CVE-2025-53727",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53727"
},
{
"name": "CVE-2025-47954",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47954"
},
{
"name": "CVE-2025-49745",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-49745"
},
{
"name": "CVE-2025-25006",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25006"
},
{
"name": "CVE-2025-49712",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-49712"
},
{
"name": "CVE-2025-24999",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24999"
},
{
"name": "CVE-2025-53728",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53728"
},
{
"name": "CVE-2025-53783",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53783"
},
{
"name": "CVE-2025-49759",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-49759"
},
{
"name": "CVE-2025-53733",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53733"
},
{
"name": "CVE-2025-53773",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53773"
},
{
"name": "CVE-2025-25007",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25007"
},
{
"name": "CVE-2025-33051",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-33051"
},
{
"name": "CVE-2025-49758",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-49758"
}
],
"initial_release_date": "2025-08-13T00:00:00",
"last_revision_date": "2025-08-13T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0689",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-08-13T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Microsoft. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-53733",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53733"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-49712",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49712"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-53783",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53783"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-25006",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-25007",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25007"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-33051",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33051"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-53772",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53772"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-53773",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53773"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-53736",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53736"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-53727",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53727"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-49745",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49745"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-24999",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24999"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-49759",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49759"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-53728",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53728"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-53760",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53760"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-49758",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49758"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-25005",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25005"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-47954",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47954"
}
]
}
FKIE_CVE-2025-25006
Vulnerability from fkie_nvd - Published: 2025-08-12 18:15 - Updated: 2025-09-03 14:51
Severity
Summary
Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
References
| URL | Tags | ||
|---|---|---|---|
| secure@microsoft.com | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | exchange_server | * | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:*:*:*:*:subscription:*:*:*",
"matchCriteriaId": "2C8A8803-ED8E-437F-B7FB-7E2F9A64A235",
"versionEndExcluding": "15.02.2562.020",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:*",
"matchCriteriaId": "8039FBA1-73D4-4FF2-B183-0DCC961CBFF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:*",
"matchCriteriaId": "56728785-188C-470A-9692-E6C7235109CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*",
"matchCriteriaId": "63E362CB-CF75-4B7E-A4B1-D6D84AFCBB68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*",
"matchCriteriaId": "9BE04790-85A2-4078-88CE-1787BC5172E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*",
"matchCriteriaId": "CCF101BE-27FD-4E2D-A694-C606BD3D1ED7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*",
"matchCriteriaId": "4DF5BDB5-205D-4B64-A49A-0152AFCF4A13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*",
"matchCriteriaId": "55284CF7-0D04-4216-83FE-4B1F9CA94207",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*",
"matchCriteriaId": "CA2CE223-AA49-49E6-AC32-59270EFF55AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*",
"matchCriteriaId": "4830D6A9-AF74-480C-8F69-8648CD619980",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*",
"matchCriteriaId": "079E1E3F-FF25-4B0D-AC98-191D6455A014",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*",
"matchCriteriaId": "29805EC7-6403-44B9-91EC-109C087E98EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*",
"matchCriteriaId": "28FCA0E8-7D27-4746-9731-91B834CA3E64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:*",
"matchCriteriaId": "996163E7-6F3F-4D3B-AEA4-62A7F7E1F54D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*",
"matchCriteriaId": "19C1EE0C-B8DD-4B91-BE4B-1C42D72FB718",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*",
"matchCriteriaId": "3BE427A4-B0C2-4064-8234-29426325C348",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_3:*:*:*:*:*:*",
"matchCriteriaId": "FE401B0A-DDE4-4A36-8E27-6DB14E094BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_4:*:*:*:*:*:*",
"matchCriteriaId": "450319C4-7C8F-43B7-B7F8-80DA4F1F2817",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_5:*:*:*:*:*:*",
"matchCriteriaId": "23015889-48AF-40A5-862F-290E73A54E77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_6:*:*:*:*:*:*",
"matchCriteriaId": "4FC34516-D7E7-4AD9-9B45-5474831548E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:*",
"matchCriteriaId": "5211792E-5292-41C0-B7E9-8AA63EC606EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*",
"matchCriteriaId": "075E907F-AF2F-4C31-86C7-51972BE412A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*",
"matchCriteriaId": "69AF19DC-3D65-49A8-A85F-511085CDF27B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "40D8A6DB-9225-4A3F-AD76-192F6CCCF002",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*",
"matchCriteriaId": "051DE6C4-7456-4C42-BC51-253208AADB4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*",
"matchCriteriaId": "B4185347-EEDD-4239-9AB3-410E2EC89D2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*",
"matchCriteriaId": "435343A4-BF10-461A-ABF2-D511A5FBDA75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*",
"matchCriteriaId": "B23C8E3E-5243-4DA6-B9AA-F6053084B55E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:*",
"matchCriteriaId": "583745C7-B802-4CBE-BD88-B5B9AF9B5371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*",
"matchCriteriaId": "EE320413-D2C9-4B28-89BF-361B44A3F0FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*",
"matchCriteriaId": "104F96DC-E280-4E0A-8586-B043B55888C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*",
"matchCriteriaId": "73B3B3FE-7E85-4B86-A983-2C410FFEF4B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*",
"matchCriteriaId": "8A9FB275-7F17-48B2-B528-BE89309D2AF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*",
"matchCriteriaId": "D4AB3C25-CEA8-4D66-AEE4-953C8B17911A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*",
"matchCriteriaId": "36CE5C6D-9A04-41F5-AE7C-265779833649",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*",
"matchCriteriaId": "44ECF39A-1DE1-4870-A494-06A53494338D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*",
"matchCriteriaId": "71CDF29B-116B-4DE2-AFD0-B62477FF0AEB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network."
},
{
"lang": "es",
"value": "El manejo inadecuado de un elemento especial adicional en Microsoft Exchange Server permite que un atacante no autorizado realice suplantaci\u00f3n de identidad a trav\u00e9s de una red."
}
],
"id": "CVE-2025-25006",
"lastModified": "2025-09-03T14:51:39.180",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "secure@microsoft.com",
"type": "Secondary"
}
]
},
"published": "2025-08-12T18:15:27.830",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-167"
}
],
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-XX53-48RW-MQ6C
Vulnerability from github – Published: 2025-08-12 18:31 – Updated: 2025-08-12 18:31
VLAI
Details
Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-25006"
],
"database_specific": {
"cwe_ids": [
"CWE-167"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-12T18:15:27Z",
"severity": "MODERATE"
},
"details": "Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.",
"id": "GHSA-xx53-48rw-mq6c",
"modified": "2025-08-12T18:31:30Z",
"published": "2025-08-12T18:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25006"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
MSRC_CVE-2025-25006
Vulnerability from csaf_microsoft - Published: 2025-08-12 07:00 - Updated: 2025-08-12 07:00Summary
Microsoft Exchange Server Spoofing Vulnerability
Severity
Important
Notes
Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Customer Action: Required. The vulnerability documented by this CVE requires customer action to resolve.
CWE-167
- Improper Handling of Additional Special Element
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.058
Microsoft Exchange Server 2016 Cumulative Update 23
|
15.01.2507.058 | ||
|
Microsoft Exchange Server 2019 Cumulative Update 14 15.02.1544.033
Microsoft Exchange Server 2019 Cumulative Update 14
|
15.02.1544.033 | ||
|
Microsoft Exchange Server 2019 Cumulative Update 15 15.02.1748.036
Microsoft Exchange Server 2019 Cumulative Update 15
|
15.02.1748.036 | ||
|
Microsoft Exchange Server Subscription Edition RTM 15.02.2562.020
Microsoft Exchange Server Subscription Edition RTM
|
15.02.2562.020 |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server Subscription Edition RTM <15.02.2562.020
Microsoft Exchange Server Subscription Edition RTM
|
<15.02.2562.020 |
Vendor Fix
fix
|
|
|
Microsoft Exchange Server 2019 Cumulative Update 15 <15.02.1748.036
Microsoft Exchange Server 2019 Cumulative Update 15
|
<15.02.1748.036 |
Vendor Fix
fix
|
|
|
Microsoft Exchange Server 2019 Cumulative Update 14 <15.02.1544.033
Microsoft Exchange Server 2019 Cumulative Update 14
|
<15.02.1544.033 |
Vendor Fix
fix
|
|
|
Microsoft Exchange Server 2016 Cumulative Update 23 <15.01.2507.058
Microsoft Exchange Server 2016 Cumulative Update 23
|
<15.01.2507.058 |
Vendor Fix
fix
|
Threats
Impact
Spoofing
Exploit Status
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely
References
7 references
| URL | Category |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | self |
| https://msrc.microsoft.com/csaf/advisories/2025/m… | self |
| https://www.microsoft.com/en-us/msrc/exploitabili… | external |
| https://support.microsoft.com/lifecycle | external |
| https://www.first.org/cvss | external |
| https://msrc.microsoft.com/update-guide/vulnerabi… | self |
| https://msrc.microsoft.com/csaf/advisories/2025/m… | self |
Acknowledgments
<a href="https://www.linkedin.com/in/anna-breeva-51476b163/">Anna Breeva</a>
{
"document": {
"acknowledgments": [
{
"names": [
"\u003ca href=\"https://www.linkedin.com/in/anna-breeva-51476b163/\"\u003eAnna Breeva\u003c/a\u003e"
]
}
],
"aggregate_severity": {
"namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
},
{
"category": "general",
"text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
"title": "Customer Action"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2025-25006 Microsoft Exchange Server Spoofing Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006"
},
{
"category": "self",
"summary": "CVE-2025-25006 Microsoft Exchange Server Spoofing Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-25006.json"
},
{
"category": "external",
"summary": "Microsoft Exploitability Index",
"url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "Microsoft Exchange Server Spoofing Vulnerability",
"tracking": {
"current_release_date": "2025-08-12T07:00:00.000Z",
"generator": {
"date": "2025-11-10T00:11:42.901Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2025-25006",
"initial_release_date": "2025-08-12T07:00:00.000Z",
"revision_history": [
{
"date": "2025-08-12T07:00:00.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c15.02.1748.036",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 15 \u003c15.02.1748.036",
"product_id": "2"
}
},
{
"category": "product_version",
"name": "15.02.1748.036",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 15 15.02.1748.036",
"product_id": "12502"
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server 2019 Cumulative Update 15"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c15.01.2507.058",
"product": {
"name": "Microsoft Exchange Server 2016 Cumulative Update 23 \u003c15.01.2507.058",
"product_id": "4"
}
},
{
"category": "product_version",
"name": "15.01.2507.058",
"product": {
"name": "Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.058",
"product_id": "12039"
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server 2016 Cumulative Update 23"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c15.02.1544.033",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 14 \u003c15.02.1544.033",
"product_id": "3"
}
},
{
"category": "product_version",
"name": "15.02.1544.033",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 14 15.02.1544.033",
"product_id": "12293"
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server 2019 Cumulative Update 14"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c15.02.2562.020",
"product": {
"name": "Microsoft Exchange Server Subscription Edition RTM \u003c15.02.2562.020",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "15.02.2562.020",
"product": {
"name": "Microsoft Exchange Server Subscription Edition RTM 15.02.2562.020",
"product_id": "16792"
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server Subscription Edition RTM"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-25006",
"cwe": {
"id": "CWE-167",
"name": "Improper Handling of Additional Special Element"
},
"notes": [
{
"category": "general",
"text": "Microsoft",
"title": "Assigning CNA"
},
{
"category": "faq",
"text": "An attacker could spoof incorrect 5322.From email address that is displayed to a user.",
"title": "According to the CVSS metrics, successful exploitation of this vulnerability could lead to no loss of confidentiality (C:N), some loss of integrity (I:L) but have no effect on availability (A:N). What is the impact of this vulnerability?"
}
],
"product_status": {
"fixed": [
"12039",
"12293",
"12502",
"16792"
],
"known_affected": [
"1",
"2",
"3",
"4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-25006 Microsoft Exchange Server Spoofing Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006"
},
{
"category": "self",
"summary": "CVE-2025-25006 Microsoft Exchange Server Spoofing Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-25006.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2025-08-12T07:00:00.000Z",
"details": "15.02.1748.036:Security Update:https://support.microsoft.com/help/5063221",
"product_ids": [
"2"
],
"url": "https://support.microsoft.com/help/5063221"
},
{
"category": "vendor_fix",
"date": "2025-08-12T07:00:00.000Z",
"details": "15.01.2507.058:Security Update:https://support.microsoft.com/help/5063223",
"product_ids": [
"4"
],
"url": "https://support.microsoft.com/help/5063223"
},
{
"category": "vendor_fix",
"date": "2025-08-12T07:00:00.000Z",
"details": "15.02.1544.033:Security Update:https://support.microsoft.com/help/5063222",
"product_ids": [
"3"
],
"url": "https://support.microsoft.com/help/5063222"
},
{
"category": "vendor_fix",
"date": "2025-08-12T07:00:00.000Z",
"details": "15.02.2562.020:Security Update:https://support.microsoft.com/help/5063224",
"product_ids": [
"1"
],
"url": "https://support.microsoft.com/help/5063224"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalsScore": 0.0,
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.6,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Spoofing"
},
{
"category": "exploit_status",
"details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely"
}
],
"title": "Microsoft Exchange Server Spoofing Vulnerability"
}
]
}
NCSC-2025-0252
Vulnerability from csaf_ncscnl - Published: 2025-08-13 07:29 - Updated: 2025-08-13 07:29Summary
Kwetsbaarheden verholpen in Microsoft Exchange Server
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Microsoft heeft kwetsbaarheden verholpen in Microsoft Exchange Server.
Interpretaties: De kwetsbaarheden in Microsoft Exchange Server zijn het gevolg van onjuiste invoervalidatie en de onjuiste behandeling van speciale elementen, waardoor ongeautoriseerde aanvallers gegevens kunnen manipuleren en communicatie kunnen vervalsen. Dit kan leiden tot ongeautoriseerde toegang, manipulatie van gegevens en blootstelling van gevoelige informatie, wat de integriteit en vertrouwelijkheid van het systeem in gevaar brengt.
```
Microsoft Exchange Server:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-33051 | 7.50 | Toegang tot gevoelige gegevens |
| CVE-2025-53786 | 8.00 | Verkrijgen van verhoogde rechten |
| CVE-2025-25005 | 6.50 | Manipuleren van data |
| CVE-2025-25006 | 5.30 | Voordoen als andere gebruiker |
| CVE-2025-25007 | 5.30 | Voordoen als andere gebruiker |
|----------------|------|-------------------------------------|
```
Oplossingen: Microsoft heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-167: Improper Handling of Additional Special Element
CWE-1286: Improper Validation of Syntactic Correctness of Input
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-20: Improper Input Validation
CWE-287: Improper Authentication
CWE-20
- Improper Input Validation
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server Subscription Edition RTM
|
cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2019 Cumulative Update 15
|
cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2016 Cumulative Update 23
|
cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2019 Cumulative Update 14
|
cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*
|
vers:microsoft/unknown |
CWE-167
- Improper Handling of Additional Special Element
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server Subscription Edition RTM
|
cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2019 Cumulative Update 15
|
cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2016 Cumulative Update 23
|
cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2019 Cumulative Update 14
|
cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*
|
vers:microsoft/unknown |
CWE-1286
- Improper Validation of Syntactic Correctness of Input
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server Subscription Edition RTM
|
cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2019 Cumulative Update 15
|
cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2016 Cumulative Update 23
|
cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2019 Cumulative Update 14
|
cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*
|
vers:microsoft/unknown |
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server Subscription Edition RTM
|
cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2019 Cumulative Update 15
|
cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2016 Cumulative Update 23
|
cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2019 Cumulative Update 14
|
cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*
|
vers:microsoft/unknown |
8.0 (High)
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server Subscription Edition RTM
|
cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2019 Cumulative Update 15
|
cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2016 Cumulative Update 23
|
cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*
|
vers:microsoft/unknown | |
|
vers:microsoft/unknown
Microsoft / Server Software / Microsoft Exchange Server 2019 Cumulative Update 14
|
cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*
|
vers:microsoft/unknown |
References
6 references
| URL | Category |
|---|---|
| https://msrc.microsoft.com/update-guide/en-us | external |
| https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… | self |
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Microsoft heeft kwetsbaarheden verholpen in Microsoft Exchange Server.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden in Microsoft Exchange Server zijn het gevolg van onjuiste invoervalidatie en de onjuiste behandeling van speciale elementen, waardoor ongeautoriseerde aanvallers gegevens kunnen manipuleren en communicatie kunnen vervalsen. Dit kan leiden tot ongeautoriseerde toegang, manipulatie van gegevens en blootstelling van gevoelige informatie, wat de integriteit en vertrouwelijkheid van het systeem in gevaar brengt. \n```\nMicrosoft Exchange Server: \n|----------------|------|-------------------------------------|\n| CVE-ID | CVSS | Impact |\n|----------------|------|-------------------------------------|\n| CVE-2025-33051 | 7.50 | Toegang tot gevoelige gegevens | \n| CVE-2025-53786 | 8.00 | Verkrijgen van verhoogde rechten | \n| CVE-2025-25005 | 6.50 | Manipuleren van data | \n| CVE-2025-25006 | 5.30 | Voordoen als andere gebruiker | \n| CVE-2025-25007 | 5.30 | Voordoen als andere gebruiker | \n|----------------|------|-------------------------------------|\n```",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Microsoft heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Handling of Additional Special Element",
"title": "CWE-167"
},
{
"category": "general",
"text": "Improper Validation of Syntactic Correctness of Input",
"title": "CWE-1286"
},
{
"category": "general",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "general",
"text": "Improper Authentication",
"title": "CWE-287"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://msrc.microsoft.com/update-guide/en-us"
}
],
"title": "Kwetsbaarheden verholpen in Microsoft Exchange Server",
"tracking": {
"current_release_date": "2025-08-13T07:29:24.639524Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.2"
}
},
"id": "NCSC-2025-0252",
"initial_release_date": "2025-08-13T07:29:24.639524Z",
"revision_history": [
{
"date": "2025-08-13T07:29:24.639524Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:microsoft/unknown",
"product": {
"name": "vers:microsoft/unknown",
"product_id": "CSAFPID-3035041",
"product_identification_helper": {
"cpe": "cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server Subscription Edition RTM"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:microsoft/unknown",
"product": {
"name": "vers:microsoft/unknown",
"product_id": "CSAFPID-3035042",
"product_identification_helper": {
"cpe": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server 2019 Cumulative Update 15"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:microsoft/unknown",
"product": {
"name": "vers:microsoft/unknown",
"product_id": "CSAFPID-3035043",
"product_identification_helper": {
"cpe": "cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server 2016 Cumulative Update 23"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:microsoft/unknown",
"product": {
"name": "vers:microsoft/unknown",
"product_id": "CSAFPID-3035044",
"product_identification_helper": {
"cpe": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server 2019 Cumulative Update 14"
}
],
"category": "product_family",
"name": "Server Software"
}
],
"category": "vendor",
"name": "Microsoft"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-25005",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
}
],
"product_status": {
"known_affected": [
"CSAFPID-3035041",
"CSAFPID-3035042",
"CSAFPID-3035043",
"CSAFPID-3035044"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-25005 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-25005.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-3035041",
"CSAFPID-3035042",
"CSAFPID-3035043",
"CSAFPID-3035044"
]
}
],
"title": "CVE-2025-25005"
},
{
"cve": "CVE-2025-25006",
"cwe": {
"id": "CWE-167",
"name": "Improper Handling of Additional Special Element"
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Additional Special Element",
"title": "CWE-167"
}
],
"product_status": {
"known_affected": [
"CSAFPID-3035041",
"CSAFPID-3035042",
"CSAFPID-3035043",
"CSAFPID-3035044"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-25006 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-25006.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-3035041",
"CSAFPID-3035042",
"CSAFPID-3035043",
"CSAFPID-3035044"
]
}
],
"title": "CVE-2025-25006"
},
{
"cve": "CVE-2025-25007",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Syntactic Correctness of Input",
"title": "CWE-1286"
}
],
"product_status": {
"known_affected": [
"CSAFPID-3035041",
"CSAFPID-3035042",
"CSAFPID-3035043",
"CSAFPID-3035044"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-25007 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-25007.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-3035041",
"CSAFPID-3035042",
"CSAFPID-3035043",
"CSAFPID-3035044"
]
}
],
"title": "CVE-2025-25007"
},
{
"cve": "CVE-2025-33051",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
}
],
"product_status": {
"known_affected": [
"CSAFPID-3035041",
"CSAFPID-3035042",
"CSAFPID-3035043",
"CSAFPID-3035044"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-33051 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-33051.json"
}
],
"title": "CVE-2025-33051"
},
{
"cve": "CVE-2025-53786",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "other",
"text": "Improper Authentication",
"title": "CWE-287"
}
],
"product_status": {
"known_affected": [
"CSAFPID-3035041",
"CSAFPID-3035042",
"CSAFPID-3035043",
"CSAFPID-3035044"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-53786 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-53786.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-3035041",
"CSAFPID-3035042",
"CSAFPID-3035043",
"CSAFPID-3035044"
]
}
],
"title": "CVE-2025-53786"
}
]
}
WID-SEC-W-2025-1781
Vulnerability from csaf_certbund - Published: 2025-08-12 22:00 - Updated: 2025-08-12 22:00Summary
Microsoft Exchange Server und Microsoft Exchange: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Microsoft Exchange Server ist das Serverprodukt für das Client-Server Groupware- und Nachrichtensystem der Firma Microsoft.
Exchange ist ein Groupware und Nachrichtensystem der Firma Microsoft.
Angriff: Ein Angreifer kann mehrere Schwachstellen in Microsoft Exchange Server und Microsoft Exchange ausnutzen, um seine Privilegien zu erhöhen, um Daten zu Manipulieren, und um Informationen offenzulegen.
Betroffene Betriebssysteme: - Windows
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server 2019 Cumulative Update 15
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_15
|
Cumulative Update 15 | |
|
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft / Exchange Server 2016
|
cpe:/a:microsoft:exchange_server_2016:cumulative_update_23
|
Cumulative Update 23 | |
|
Microsoft Exchange Server 2019 Cumulative Update 14
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_14
|
Cumulative Update 14 | |
|
Microsoft Exchange Server Subscription Edition RTM
Microsoft / Exchange
|
cpe:/a:microsoft:exchange:server
|
Server Subscription Edition RTM |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server 2019 Cumulative Update 15
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_15
|
Cumulative Update 15 | |
|
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft / Exchange Server 2016
|
cpe:/a:microsoft:exchange_server_2016:cumulative_update_23
|
Cumulative Update 23 | |
|
Microsoft Exchange Server 2019 Cumulative Update 14
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_14
|
Cumulative Update 14 | |
|
Microsoft Exchange Server Subscription Edition RTM
Microsoft / Exchange
|
cpe:/a:microsoft:exchange:server
|
Server Subscription Edition RTM |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server 2019 Cumulative Update 15
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_15
|
Cumulative Update 15 | |
|
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft / Exchange Server 2016
|
cpe:/a:microsoft:exchange_server_2016:cumulative_update_23
|
Cumulative Update 23 | |
|
Microsoft Exchange Server 2019 Cumulative Update 14
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_14
|
Cumulative Update 14 | |
|
Microsoft Exchange Server Subscription Edition RTM
Microsoft / Exchange
|
cpe:/a:microsoft:exchange:server
|
Server Subscription Edition RTM |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server 2019 Cumulative Update 15
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_15
|
Cumulative Update 15 | |
|
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft / Exchange Server 2016
|
cpe:/a:microsoft:exchange_server_2016:cumulative_update_23
|
Cumulative Update 23 | |
|
Microsoft Exchange Server 2019 Cumulative Update 14
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_14
|
Cumulative Update 14 | |
|
Microsoft Exchange Server Subscription Edition RTM
Microsoft / Exchange
|
cpe:/a:microsoft:exchange:server
|
Server Subscription Edition RTM |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server 2019 Cumulative Update 15
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_15
|
Cumulative Update 15 | |
|
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft / Exchange Server 2016
|
cpe:/a:microsoft:exchange_server_2016:cumulative_update_23
|
Cumulative Update 23 | |
|
Microsoft Exchange Server 2019 Cumulative Update 14
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_14
|
Cumulative Update 14 | |
|
Microsoft Exchange Server Subscription Edition RTM
Microsoft / Exchange
|
cpe:/a:microsoft:exchange:server
|
Server Subscription Edition RTM |
References
3 references
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Microsoft Exchange Server ist das Serverprodukt f\u00fcr das Client-Server Groupware- und Nachrichtensystem der Firma Microsoft.\r\nExchange ist ein Groupware und Nachrichtensystem der Firma Microsoft.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Microsoft Exchange Server und Microsoft Exchange ausnutzen, um seine Privilegien zu erh\u00f6hen, um Daten zu Manipulieren, und um Informationen offenzulegen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-1781 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1781.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-1781 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1781"
},
{
"category": "external",
"summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates",
"url": "https://msrc.microsoft.com/update-guide/"
}
],
"source_lang": "en-US",
"title": "Microsoft Exchange Server und Microsoft Exchange: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-08-12T22:00:00.000+00:00",
"generator": {
"date": "2025-08-13T07:42:11.513+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.4.0"
}
},
"id": "WID-SEC-W-2025-1781",
"initial_release_date": "2025-08-12T22:00:00.000+00:00",
"revision_history": [
{
"date": "2025-08-12T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "Server Subscription Edition RTM",
"product": {
"name": "Microsoft Exchange Server Subscription Edition RTM",
"product_id": "T020619",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:exchange:server"
}
}
}
],
"category": "product_name",
"name": "Exchange"
},
{
"branches": [
{
"category": "product_version",
"name": "Cumulative Update 23",
"product": {
"name": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product_id": "T023152",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:exchange_server_2016:cumulative_update_23"
}
}
}
],
"category": "product_name",
"name": "Exchange Server 2016"
},
{
"branches": [
{
"category": "product_version",
"name": "Cumulative Update 14",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 14",
"product_id": "T032780",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:exchange_server_2019:cumulative_update_14"
}
}
},
{
"category": "product_version",
"name": "Cumulative Update 15",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 15",
"product_id": "T045946",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:exchange_server_2019:cumulative_update_15"
}
}
}
],
"category": "product_name",
"name": "Exchange Server 2019"
}
],
"category": "vendor",
"name": "Microsoft"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-25005",
"product_status": {
"known_affected": [
"T045946",
"T023152",
"T032780",
"T020619"
]
},
"release_date": "2025-08-12T22:00:00.000+00:00",
"title": "CVE-2025-25005"
},
{
"cve": "CVE-2025-25006",
"product_status": {
"known_affected": [
"T045946",
"T023152",
"T032780",
"T020619"
]
},
"release_date": "2025-08-12T22:00:00.000+00:00",
"title": "CVE-2025-25006"
},
{
"cve": "CVE-2025-25007",
"product_status": {
"known_affected": [
"T045946",
"T023152",
"T032780",
"T020619"
]
},
"release_date": "2025-08-12T22:00:00.000+00:00",
"title": "CVE-2025-25007"
},
{
"cve": "CVE-2025-33051",
"product_status": {
"known_affected": [
"T045946",
"T023152",
"T032780",
"T020619"
]
},
"release_date": "2025-08-12T22:00:00.000+00:00",
"title": "CVE-2025-33051"
},
{
"cve": "CVE-2025-53786",
"product_status": {
"known_affected": [
"T045946",
"T023152",
"T032780",
"T020619"
]
},
"release_date": "2025-08-12T22:00:00.000+00:00",
"title": "CVE-2025-53786"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…