Overview
Microsoft issued patches for 111 CVE-rated vulnerabilities.
- One Zero-Day vulnerability (CVE_2025-53779) Windows Kerberos Elevation of Privilege
- 13 Critical vulnerabilities
Quorum Cyber Recommendations
Patching should be completed within your regular cycles and without delay. We do not at this time recommend expedited patching.
Microsoft Release Notes
August 2025 Security Updates – Release Notes – Security Update Guide – Microsoft
Key Vulnerability Details
| Title | Windows Kerberos Elevation of Privilege Vulnerability |
| CVE | CVE-2025-53779 |
| CVSS | 7.2 |
| Reason for Concern | This is a high-priority vulnerability due to its potential for domain-wide compromise. |
| Mitigations and other factors | – Apply the official Microsoft patch immediately. – Review Kerberos configurations and ensure defence-in-depth measures (e.g., segmentation, EDR, KDC proxy hardening). – Monitor for suspicious Kerberos activity (e.g., Event ID 4769) and validate ticket issuance paths. |
| Commentary | The vulnerability was discovered by Yuval Gordon, Akamai (Alias: BadSuccessor) |
| Threat Intelligence Comment | CVE-2025-53779 is a relative path traversal vulnerability in Windows Kerberos that allows an authorised attacker to elevate privileges over a network. The vulnerability has a CVSS score of 7.2, indicating a high severity level. The impact of CVE-2025-53779 can be significant, allowing attackers to gain domain administrator privileges, which can lead to unauthorised access to sensitive data, lateral movement within the network, and potential full domain compromise. Financially, organisations may face costs related to incident response, remediation, and potential regulatory fines. Operationally, the breach could disrupt services and damage reputations, leading to loss of customer trust. Exploitation of CVE-2025-53779 requires an attacker to have access to specific attributes of Delegated Managed Service Accounts (dMSA) within Active Directory. By manipulating these attributes, an attacker can escalate privileges. The vulnerability’s exploitation is considered less likely due to the requirement of elevated access, but the potential for significant impact remains. |
| Link | CVE-2025-53779 – Security Update Guide – Microsoft – Windows Kerberos Elevation of Privilege Vulnerability
|
| Title | Exchange Hybrid Privilege Escalation Vulnerability |
| CVE | CVE-2025-53786 |
| CVSS | 8.0 |
| Reason for Concern | Risk of full domain compromise: Attackers can pivot from on-premises to cloud, potentially compromising Active Directory and sensitive messaging infrastructure. Cloud trust abuse: Exploits the hybrid trust relationship, undermining the integrity of cloud authentication. No active exploitation reported, but the vulnerability is publicly disclosed and considered high-risk. Affected Systems: – Microsoft Exchange Server 2016 (Hybrid deployments) – Microsoft Exchange Server 2019 (Hybrid deployments) – Exchange Subscription Edition (RTM) |
| Mitigations and other factors | Patch immediately using the April 2025 hotfix or newer cumulative updates. Deploy the Dedicated Exchange Hybrid App in Entra ID to replace the legacy shared principal. Reset shared credentials and remove residual trust configurations. Run Microsoft Exchange Health Checker to validate hybrid configuration integrity. Use Microsoft Defender Vulnerability Management (MDVM) to detect exposed devices and track remediation progress. |
| Commentary | The vulnerability was discovered and disclosed by Microsoft Corporation as part of its internal security investigations into hybrid Exchange deployments |
| Threat Intelligence Comment | CVE-2025-53786 is a high-severity vulnerability affecting Microsoft Exchange Server hybrid deployments, allowing an attacker with administrative access to escalate privileges within the connected Microsoft 365 environment. The impact of CVE-2025-53786 can lead to significant impacts on an organisation’s operations, data integrity, and overall security posture. Attackers can gain unauthorised access to sensitive information, potentially leading to data breaches, financial losses, and reputational damage. The ability to escalate privileges without detection poses a severe risk, as it allows attackers to manipulate cloud resources and data. Exploitation of CVE-2025-53786 requires an attacker to have administrative access to an on-premises Exchange server. Once access is gained, the attacker can exploit the shared service principal to escalate privileges within the connected cloud environment, allowing them to impersonate users and bypass security measures. |
| Link | CVE-2025-53786 – Security Update Guide – Microsoft – Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability |
