The Cybersecurity and Infrastructure Security Agency (CISA) and Microsoft on Tuesday updated their mitigation guidance for a high-severity flaw in Exchange Server.

The flaw, tracked as CVE-2025-53786, could allow an attacker with administrative privileges for on-premises versions of Exchange to escalate privileges by exploiting vulnerable hybrid joined configurations, Microsoft and CISA said last week. 

In an update on Tuesday, CISA said it still saw no evidence of hackers exploiting the flaw, but it urged organizations to review Microsoft’s updated guidance on identifying Exchange Servers on a network and running the Microsoft Exchange Health Checker. 

In its updated security bulletin, Microsoft said an attacker could potentially escalate privileges from an on-premises server to a connected cloud environment without leaving an “easily detectable and auditable trace.”

Last week, the company urged users of on-premises Exchange servers to download its April 2025 Exchange Server hotfix updates. It also recommended that customers disconnect any internet-connected Exchange or SharePoint servers that have reached end-of-life status. 

“An attacker would need to have obtained a highly privileged role to an on-premises server to attempt this exploitation,” a Microsoft spokesperson told Cybersecurity Dive on Tuesday. “We are deploying mitigations to protect against these risks while following an extensive process involving a thorough investigation, updated developments across all affected versions, and compatibility testing, to ensure maximized customer protection with minimized operational disruption.”