The Exchange hybrid vulnerability (CVE-2025-53786) made a lot of noise this week, and it drags a topic back into view that many admins hoped they were done with. In a large share of the environments I review, Exchange Hybrid was set up during the migration and then left alone. Nobody audits it, yet it still holds high privileges both on-prem and in the cloud. If you run Exchange Hybrid, your cloud is only as secure as your on-prem server, and that matters even more when the identities are this tightly linked.

The Exchange hybrid vulnerability (CVE-2025-53786) exploits a shared service principal

The root cause is an old design decision. Classic Exchange Hybrid setups use one and the same Entra ID service principal for the on-prem Exchange server and for Exchange Online. Because the identity is shared, an attacker who breaches the on-prem Exchange server (and far too many of them are still unpatched) can escalate privileges across the entire Microsoft 365 tenant. Microsoft published details and guidance on August 6. The US CISA followed with an emergency directive, which tells you how seriously this should be taken in regulated sectors and by anyone who handles sensitive mail data.

Practical tip: Even if your on-prem Exchange is there "only for SMTP relay or user management", treat its patching and health as a core part of your Microsoft 365 security. Anything that talks to the cloud can also damage it.

Microsoft now wants Exchange Hybrid to run on a dedicated hybrid app

Microsoft announced the change back in April 2025. Exchange Hybrid should stop using the same service principal as Exchange Online. You deploy a dedicated Exchange Hybrid app instead, with its own service principal and narrowly scoped permissions, so nothing is shared anymore. What started as a recommendation is now an urgent mitigation. If a compromised on-prem Exchange server can't act under Exchange Online's identity, the privilege escalation never gets going.

The flowchart below shows the new architecture, which is the safer one:

flowchart TD
    UserLogin["Admin logs in to Exchange Server"]
    OnPremExchange["Exchange On-Prem Server"]
    HybridApp["Dedicated Hybrid App (Service Principal)"]
    ExO["Exchange Online"]
    UserLogin --> OnPremExchange
    OnPremExchange --> HybridApp
    HybridApp --> ExO

Figure: The dedicated hybrid app sits between Exchange On-Prem and Exchange Online as a separate identity and prevents privilege escalation.

For the full technical details, see Microsoft's documentation on hybrid deployments and the dedicated app.

Four steps close the gap in your hybrid setup

If you operate Exchange Hybrid, don't put this off:

  1. Install the latest Exchange Server updates (the April 2025 hotfix at minimum, or newer) on every hybrid Exchange server. Without them you can't move to the new model safely.
  2. Run the ConfigureExchangeHybridApplication.ps1 script to create the dedicated hybrid app and its service principal in your Entra ID tenant. Get the current script and instructions from Microsoft's docs.
  3. Reset the keyCredentials of the old (shared) service principal. This invalidates old credentials that could be abused if your on-prem server has already been compromised.
  4. Run the Exchange Health Checker (a PowerShell script from the Exchange support repo) to confirm that all hotfixes are installed and the hybrid app is configured correctly.

Admins keep tripping over the same pitfalls in the field

In my experience, a lot of admins trust an old hybrid connector because "it's always worked", and they rarely stop to look at which permissions are sitting in Entra ID. Moving to a dedicated hybrid app is no longer optional, not now that CISA and Microsoft have both issued explicit warnings.

The keyCredential reset is the step people skip most often. Running the script on servers that aren't fully patched, or without the right admin rights, ends in errors that waste your time. Make sure your Exchange servers are completely up to date and that you hold the Global Admin role in your Entra tenant. If you still use Entra Connect, read my post on hardening Entra Connect as Tier-0 as well.

Hybrid remains high risk and cloud-only looks better every day

If an on-prem Exchange server is still running somewhere in the background, this vulnerability should put an end to the idea that "we're all in the cloud now". Plenty of organizations have grown comfortable with hybrid. As of this month, every one of them needs to ask honestly whether Exchange Hybrid is still worth the risk. If you have to keep it, watch your service principals, run health checks regularly and keep patching. Microsoft's new architecture helps, but the responsibility for security stays with you.

I'm curious how many organizations will actually make the change. Exchange Hybrid has to stay on your list as an active security issue, not something you ticked off years ago.