轉發 台灣電腦網路危機處理暨協調中心 TWCERTCC-200-202508-00000004

[內容說明]
微軟針對旗下產品Exchange Server發布重大資安漏洞公告(CVE-2025-53786，CVSS：8.0)，此漏洞允許取得管理者權限的攻擊者，針對雲地混合部署的環境提升權限。目前雲端環境的日誌監控工具無法紀錄此漏洞的惡意活動。

該漏洞相關PoC已於近日在美國黑帽大會 (Black Hat) 公開展示，可能加速攻擊者的後續利用，Microsoft 已釋出安全性更新與提供暫時緩解措施，建議儘速採取暫時緩解措施，以防止針對此漏洞可能的攻擊發生。

[影響平台]
● Microsoft Exchange Server Subscription Edition RTM 15.02.0.0 至 15.02.2562.017 版本
● Microsoft Exchange Server 2016 Cumulative Update 23 15.01.0 至 15.01.2507.055版本
● Microsoft Exchange Server 2019 Cumulative Update 14 15.02.0.0 至 15.02.1544.025版本
● Microsoft Exchange Server 2019 Cumulative Update 15 15.02.0 至 15.02.1748.024版本

[建議措施]
根據官方網站釋出解決方式進行修補：
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53786

[參考資料]
1 https://www.twcert.org.tw/tw/cp-169-10316-60f9c-1.html
Forwarded by Taiwan Computer Network Crisis and Coordination Center (TWCERTCC-200-202508-00000004)

[Description]
Microsoft has released a critical security vulnerability advisory (CVE-2025-53786, CVSS: 8.0) for its Exchange Server product. This vulnerability allows an attacker with administrator privileges to escalate privileges in a hybrid cloud-on-premises deployment. Currently, log monitoring tools in cloud environments cannot record malicious activity related to this vulnerability.

A proof-of-concept (PoC) for this vulnerability was recently demonstrated publicly at the Black Hat conference in the United States, potentially facilitating subsequent exploitation by attackers. Microsoft has released security updates and provided temporary mitigation measures. It is recommended that temporary mitigation measures be implemented as soon as possible to prevent potential attacks targeting this vulnerability.

[Affected Platforms]
● Microsoft Exchange Server Subscription Edition RTM versions 15.02.0.0 to 15.02.2562.017
● Microsoft Exchange Server 2016 Cumulative Update 23 versions 15.01.0 to 15.01.2507.055
● Microsoft Exchange Server 2019 Cumulative Update 14 versions 15.02.0.0 to 15.02.1544.025
● Microsoft Exchange Server 2019 Cumulative Update 15 versions 15.02.0 to 15.02.1748.024

[Recommended Action]
Patch according to the workaround released on the official website:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53786

[References]
1 https://www.twcert.org.tw/tw/cp-169-10316-60f9c-1.html