![\"Microsoft](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/08\/1754848269_881_960x0.jpg\")
<\/p>\n<\/p>\n
CISA issues Microsoft Exchange Server CVE-2025-53786 warning<\/p>\n
Getty Images<\/p>\n
Update, August 10, 2025: This story, originally published on August 7, has been updated with additional information following a demonstration of the shared service principal exploit at the Black Hat hacking conference in Las Vegas, which, in turn, follows a Microsoft Exchange vulnerability directive issued by CISA. Details of a newly announced protection that adds to the Microsoft Defender security arsenal have also been added to the article. <\/p>\n
Hot on the heels of an official security advisory from America\u2019s Cyber Defense Agency warning of camera hack attacks<\/a>, the U.S. Cybersecurity and Infrastructure Security Agency has issued another alert. This time, it impacts users of Microsoft Exchange Server and, without immediate remediation, could enable an attacker to escalate privileges and \u201cimpact the identity integrity of an organization\u2019s Exchange Online service.\u201d But it\u2019s not all bad news on the Microsoft security front; the technology giant has confirmed new AI-powered protections to autonomously reverse engineer and classify malware, importantly, without any prior context requirement. Here\u2019s what you need to know.<\/p>\n ForbesGoogle Cloud Hack Attack Confirmed \u2014 Do These 3 Things NowBy Davey Winder<\/a><\/p>\n CISA And Microsoft Warn Users Of CVE-2025-53786 Attack Danger<\/p>\n There have been a number of security warnings impacting Microsoft users of late that may have caught your attention: the Windows JPEG hackers<\/a> and, of course, the by now infamous SharePoint Server attacks<\/a> to name but two. The very latest, however, comes with the added weight of a CISA alert attached.<\/p>\n \u201cCISA is aware of the newly disclosed high-severity vulnerability, CVE-2025-53786,\u201d the August 6 advisory<\/a> warned, \u201cthat allows a cyber threat actor with administrative access to an on-premise Microsoft Exchange server to escalate privileges by exploiting vulnerable hybrid-joined configurations.\u201d<\/p>\n Microsoft, meanwhile, has said<\/a> that \u201cstarting in August 2025, we will begin temporarily blocking Exchange Web Services traffic using the Exchange Online shared service principal,\u201d as part of a \u201cphased strategy to speed up customer adoption of the dedicated Exchange hybrid app and making our customers\u2019 environments more secure.\u201d<\/p>\n Although CISA confirmed that there has not been any observed active exploitation of CVE-2025-53786, it strongly urged organizations to follow the Microsoft guidance on this issue.<\/p>\n CVE-2025-53786 is officially listed as a Microsoft Exchange Server Hybrid Deployment elevation of privilege vulnerability that follows an accompanying non-security hot fix when the hybrid deployments were announced on April 18. \u201cFollowing further investigation,\u201d the official Common Vulnerabilities and Exposures database entry reads, \u201cMicrosoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement.\u201d<\/p>\n CISA added that it \u201chighly recommends entities disconnect public-facing versions of Exchange Server or SharePoint Server that have reached their end-of-life (EOL) or end-of-service from the internet.\u201d<\/p>\n ForbesMicrosoft Windows Security Bypass \u2014 Hello Hackers Use Own FacesBy Davey Winder<\/a> A researcher from Outsider Security, Dirk-Jan Mollema, has now demonstrated how the shared service principal behind the latest CISA advisory and directive can be exploited. The demonstration, during a presentation at the Black Hat hacking conference in Las Vegas, went ahead after Microsoft was informed of its contents three weeks prior, Mollema told reporters from the Bleeping Computer<\/a> cybersecurity site. As a result, the CVE-2025-53786 classification was made, and Microsoft issued the aforementioned mitigation guidance. “The report describing the possibilities for attackers was sent as a heads up to the Microsoft Security Response Center three weeks before Black Hat,\u201d Mollema confirmed, adding that \u201caside from this guidance Microsoft also mitigated an attack path that could lead to full tenant compromise (Global Admin) from on-prem Exchange.”<\/p>\n The shared service principle being that, at least in such hybrid configurations as relevant to the Microsoft Exchange warning, both Exchange Online and on-premises servers share a relationship of trust that allows them to, supposedly securely, authenticate with each other. As the Black demonstration showed, provided the attacker has admin privileges for the on-premise Exchange server, so-called trusted tokens can be forged, and API calls manipulated, so as to appear perfectly legitimate as far as the cloud side of the authentication equation is concerned.<\/p>\n In speaking to Bleeping Computer, Mollema said that installing the Microsoft Hotfix alone would not be enough to mitigate the risk of these attacks, and that \u201cthere are manual follow-up actions required to migrate to a dedicated service principal.\u201d<\/p>\n ForbesConfirmed: Google Has Been Hacked \u2014 User Data CompromisedBy Davey Winder<\/a> To balance the Microsoft security news scales a little, it has also been announced that a new \u201cautonomous AI agent that can analyze and classify software without assistance.\u201d In other words, fully reverse engineer a software file in order to classify potential malware and do so without \u201cany clues about its origin or purpose.\u201d Something that, Microsoft said, is not only a step forward in cybersecurity and malware detection, but also the gold standard in malware classification.<\/p>\n
\nMicrosoft Shared Service Principal Exploit Demonstrated At Black Hat Hacking Conference In Las Vegas<\/p>\n
\nMicrosoft Announces Project Ire, Calling It The Gold Standard In AI Malware Classification<\/p>\n