CVE-2025-59249 describes a critical weak authentication vulnerability in Microsoft Exchange Server, allowing an authorized attacker to elevate privileges over a network. With a CVSS score of 8.8 (HIGH), this flaw is easily exploitable remotely with low complexity and no user interaction, leading to high impact on confidentiality, integrity, and availability. While not currently listed in CISA's KEV catalog or having public exploit code, its high FAUCET Risk Score of 83/100 and significant media coverage (2 articles) indicate a notable concern within the cybersecurity community. Although community discussion is limited, the potential for severe impact necessitates prompt patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.