CVE-2025-64666

Published: Dec 9, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: NVD

Description

Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Affected (38)

Products: Microsoft: Exchange Server, Exchange Server Subscription Edition

Microsoft

2 products

Exchange Server

Exchange Server Subscription Edition

Configuration A

38 vulnerable

Vulnerable Software	Affected Versions
Microsoft Exchange Server	Version 2016
Microsoft Exchange Server	Version 2016 cumulative_update_10
Microsoft Exchange Server	Version 2016 cumulative_update_11
Microsoft Exchange Server	Version 2016 cumulative_update_12
Microsoft Exchange Server	Version 2016 cumulative_update_13
Microsoft Exchange Server	Version 2016 cumulative_update_14
Microsoft Exchange Server	Version 2016 cumulative_update_15
Microsoft Exchange Server	Version 2016 cumulative_update_16
Microsoft Exchange Server	Version 2016 cumulative_update_17
Microsoft Exchange Server	Version 2016 cumulative_update_18
Microsoft Exchange Server	Version 2016 cumulative_update_19
Microsoft Exchange Server	Version 2016 cumulative_update_1
Microsoft Exchange Server	Version 2016 cumulative_update_20
Microsoft Exchange Server	Version 2016 cumulative_update_21
Microsoft Exchange Server	Version 2016 cumulative_update_22
Microsoft Exchange Server	Version 2016 cumulative_update_2
Microsoft Exchange Server	Version 2016 cumulative_update_3
Microsoft Exchange Server	Version 2016 cumulative_update_4
Microsoft Exchange Server	Version 2016 cumulative_update_5
Microsoft Exchange Server	Version 2016 cumulative_update_6
Microsoft Exchange Server	Version 2016 cumulative_update_7
Microsoft Exchange Server	Version 2016 cumulative_update_8
Microsoft Exchange Server	Version 2016 cumulative_update_9
Microsoft Exchange Server	Version 2019
Microsoft Exchange Server	Version 2019 cumulative_update_10
Microsoft Exchange Server	Version 2019 cumulative_update_11
Microsoft Exchange Server	Version 2019 cumulative_update_12
Microsoft Exchange Server	Version 2019 cumulative_update_13
Microsoft Exchange Server	Version 2019 cumulative_update_1
Microsoft Exchange Server	Version 2019 cumulative_update_2
Microsoft Exchange Server	Version 2019 cumulative_update_3
Microsoft Exchange Server	Version 2019 cumulative_update_4
Microsoft Exchange Server	Version 2019 cumulative_update_5
Microsoft Exchange Server	Version 2019 cumulative_update_6
Microsoft Exchange Server	Version 2019 cumulative_update_7
Microsoft Exchange Server	Version 2019 cumulative_update_8
Microsoft Exchange Server	Version 2019 cumulative_update_9
Microsoft Exchange Server Subscription Edition	Before 15.02.2562.035

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64666

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.