CVE-2025-64667: Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
Other sources
User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1748.042Patch KB5071875 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.2562.035Patch KB5071876 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.01.2507.063Patch KB5071873 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1544.037Patch KB5071874
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64667?
CVE-2025-64667 is considered a medium severity spoofing vulnerability affecting Microsoft Exchange Server.
How do I fix CVE-2025-64667?
To fix CVE-2025-64667, apply the latest security update provided by Microsoft for your version of Exchange Server.
What versions of Microsoft Exchange Server are affected by CVE-2025-64667?
CVE-2025-64667 affects Microsoft Exchange Server 2016, 2019, and the Subscription Edition.
What type of attack can CVE-2025-64667 enable?
CVE-2025-64667 can enable an unauthorized attacker to perform spoofing attacks over a network.
Is authentication required to exploit CVE-2025-64667?
No, CVE-2025-64667 does not require authentication to exploit, making it particularly dangerous.