CVE-2025-33051

Published: Aug 12, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: secure@microsoft.com (Secondary)

Description

Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

Affected (38)

Products: Microsoft: Exchange Server, Exchange Server Subscription Edition

Microsoft

2 products

Exchange Server

Exchange Server Subscription Edition

Configuration A

38 vulnerable

Vulnerable Software	Affected Versions
Microsoft Exchange Server	Version 2016
Microsoft Exchange Server	Version 2016 cumulative_update_10
Microsoft Exchange Server	Version 2016 cumulative_update_11
Microsoft Exchange Server	Version 2016 cumulative_update_12
Microsoft Exchange Server	Version 2016 cumulative_update_13
Microsoft Exchange Server	Version 2016 cumulative_update_14
Microsoft Exchange Server	Version 2016 cumulative_update_15
Microsoft Exchange Server	Version 2016 cumulative_update_16
Microsoft Exchange Server	Version 2016 cumulative_update_17
Microsoft Exchange Server	Version 2016 cumulative_update_18
Microsoft Exchange Server	Version 2016 cumulative_update_19
Microsoft Exchange Server	Version 2016 cumulative_update_1
Microsoft Exchange Server	Version 2016 cumulative_update_20
Microsoft Exchange Server	Version 2016 cumulative_update_21
Microsoft Exchange Server	Version 2016 cumulative_update_22
Microsoft Exchange Server	Version 2016 cumulative_update_2
Microsoft Exchange Server	Version 2016 cumulative_update_3
Microsoft Exchange Server	Version 2016 cumulative_update_4
Microsoft Exchange Server	Version 2016 cumulative_update_5
Microsoft Exchange Server	Version 2016 cumulative_update_6
Microsoft Exchange Server	Version 2016 cumulative_update_7
Microsoft Exchange Server	Version 2016 cumulative_update_8
Microsoft Exchange Server	Version 2016 cumulative_update_9
Microsoft Exchange Server	Version 2019
Microsoft Exchange Server	Version 2019 cumulative_update_10
Microsoft Exchange Server	Version 2019 cumulative_update_11
Microsoft Exchange Server	Version 2019 cumulative_update_12
Microsoft Exchange Server	Version 2019 cumulative_update_13
Microsoft Exchange Server	Version 2019 cumulative_update_1
Microsoft Exchange Server	Version 2019 cumulative_update_2
Microsoft Exchange Server	Version 2019 cumulative_update_3
Microsoft Exchange Server	Version 2019 cumulative_update_4
Microsoft Exchange Server	Version 2019 cumulative_update_5
Microsoft Exchange Server	Version 2019 cumulative_update_6
Microsoft Exchange Server	Version 2019 cumulative_update_7
Microsoft Exchange Server	Version 2019 cumulative_update_8
Microsoft Exchange Server	Version 2019 cumulative_update_9
Microsoft Exchange Server Subscription Edition	Before 15.02.2562.020

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33051

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.