{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64667", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-11-06T23:40:37.276Z", "datePublished": "2025-12-09T17:55:44.488Z", "dateUpdated": "2026-04-16T14:18:39.361Z"}, "containers": {"cna": {"title": "Microsoft Exchange Server Spoofing Vulnerability", "datePublic": "2025-12-09T08:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*", "versionStartIncluding": "15.02.0.0", "versionEndExcluding": "15.02.2562.035"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*", "versionStartIncluding": "15.01.0.0", "versionEndExcluding": "15.01.2507.063"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*", "versionStartIncluding": "15.02.0.0", "versionEndExcluding": "15.02.1748.042"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*", "versionStartIncluding": "15.02.0.0", "versionEndExcluding": "15.02.1544.037"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Exchange Server 2016 Cumulative Update 23", "platforms": ["x64-based Systems"], "versions": [{"version": "15.01.0.0", "lessThan": "15.01.2507.063", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Exchange Server 2019 Cumulative Update 14", "platforms": ["x64-based Systems"], "versions": [{"version": "15.02.0.0", "lessThan": "15.02.1544.037", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Exchange Server 2019 Cumulative Update 15", "platforms": ["x64-based Systems"], "versions": [{"version": "15.02.0.0", "lessThan": "15.02.1748.042", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Exchange Server Subscription Edition RTM", "platforms": ["x64-based Systems"], "versions": [{"version": "15.02.0.0", "lessThan": "15.02.2562.035", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-451: User Interface (UI) Misrepresentation of Critical Information", "lang": "en-US", "type": "CWE", "cweId": "CWE-451"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-04-16T14:18:39.361Z"}, "references": [{"name": "Microsoft Exchange Server Spoofing Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64667"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-09T20:16:19.128228Z", "id": "CVE-2025-64667", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T20:39:59.188Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64667", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T20:16:19.128228Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T20:16:22.276Z"}}], "cna": {"title": "Microsoft Exchange Server Spoofing Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Exchange Server 2016 Cumulative Update 23", "versions": [{"status": "affected", "version": "15.01.0.0", "lessThan": "15.01.2507.063", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft Exchange Server 2019 Cumulative Update 14", "versions": [{"status": "affected", "version": "15.02.0.0", "lessThan": "15.02.1544.037", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft Exchange Server 2019 Cumulative Update 15", "versions": [{"status": "affected", "version": "15.02.0.0", "lessThan": "15.02.1748.042", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft Exchange Server Subscription Edition RTM", "versions": [{"status": "affected", "version": "15.02.0.0", "lessThan": "15.02.2562.035", "versionType": "custom"}], "platforms": ["x64-based Systems"]}], "datePublic": "2025-12-09T08:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64667", "name": "Microsoft Exchange Server Spoofing Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-451", "description": "CWE-451: User Interface (UI) Misrepresentation of Critical Information"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "15.02.2562.035", "versionStartIncluding": "15.02.0.0"}, {"criteria": "cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "15.01.2507.063", "versionStartIncluding": "15.01.0.0"}, {"criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "15.02.1748.042", "versionStartIncluding": "15.02.0.0"}, {"criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "15.02.1544.037", "versionStartIncluding": "15.02.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-04-16T14:18:39.361Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64667", "state": "PUBLISHED", "dateUpdated": "2026-04-16T14:18:39.361Z", "dateReserved": "2025-11-06T23:40:37.276Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2025-12-09T17:55:44.488Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:exchange_server:*:*:*:*:subscription:*:*:*", "matchCriteriaId": "AD6F2ED1-498D-489C-8F5A-4EBDF3AB854D", "versionEndExcluding": "15.02.2562.035", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:*", "matchCriteriaId": "8039FBA1-73D4-4FF2-B183-0DCC961CBFF7", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:*", "matchCriteriaId": "56728785-188C-470A-9692-E6C7235109CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*", "matchCriteriaId": "63E362CB-CF75-4B7E-A4B1-D6D84AFCBB68", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*", "matchCriteriaId": "9BE04790-85A2-4078-88CE-1787BC5172E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*", "matchCriteriaId": "CCF101BE-27FD-4E2D-A694-C606BD3D1ED7", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*", "matchCriteriaId": "4DF5BDB5-205D-4B64-A49A-0152AFCF4A13", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*", "matchCriteriaId": "55284CF7-0D04-4216-83FE-4B1F9CA94207", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*", "matchCriteriaId": "CA2CE223-AA49-49E6-AC32-59270EFF55AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*", "matchCriteriaId": "4830D6A9-AF74-480C-8F69-8648CD619980", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*", "matchCriteriaId": "079E1E3F-FF25-4B0D-AC98-191D6455A014", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*", "matchCriteriaId": "29805EC7-6403-44B9-91EC-109C087E98EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*", "matchCriteriaId": "28FCA0E8-7D27-4746-9731-91B834CA3E64", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:*", "matchCriteriaId": "996163E7-6F3F-4D3B-AEA4-62A7F7E1F54D", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*", "matchCriteriaId": "19C1EE0C-B8DD-4B91-BE4B-1C42D72FB718", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*", "matchCriteriaId": "3BE427A4-B0C2-4064-8234-29426325C348", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*", "matchCriteriaId": "449CE85B-E599-44D3-A7C1-5133F6A55E86", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_3:*:*:*:*:*:*", "matchCriteriaId": "FE401B0A-DDE4-4A36-8E27-6DB14E094BE2", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_4:*:*:*:*:*:*", "matchCriteriaId": "450319C4-7C8F-43B7-B7F8-80DA4F1F2817", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_5:*:*:*:*:*:*", "matchCriteriaId": "23015889-48AF-40A5-862F-290E73A54E77", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_6:*:*:*:*:*:*", "matchCriteriaId": "4FC34516-D7E7-4AD9-9B45-5474831548E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:*", "matchCriteriaId": "5211792E-5292-41C0-B7E9-8AA63EC606EE", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*", "matchCriteriaId": "075E907F-AF2F-4C31-86C7-51972BE412A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*", "matchCriteriaId": "69AF19DC-3D65-49A8-A85F-511085CDF27B", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*", "matchCriteriaId": "40D8A6DB-9225-4A3F-AD76-192F6CCCF002", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*", "matchCriteriaId": "051DE6C4-7456-4C42-BC51-253208AADB4E", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*", "matchCriteriaId": "B4185347-EEDD-4239-9AB3-410E2EC89D2A", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*", "matchCriteriaId": "435343A4-BF10-461A-ABF2-D511A5FBDA75", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*", "matchCriteriaId": "B23C8E3E-5243-4DA6-B9AA-F6053084B55E", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:*", "matchCriteriaId": "583745C7-B802-4CBE-BD88-B5B9AF9B5371", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*", "matchCriteriaId": "EE320413-D2C9-4B28-89BF-361B44A3F0FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*", "matchCriteriaId": "104F96DC-E280-4E0A-8586-B043B55888C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*", "matchCriteriaId": "73B3B3FE-7E85-4B86-A983-2C410FFEF4B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*", "matchCriteriaId": "8A9FB275-7F17-48B2-B528-BE89309D2AF5", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*", "matchCriteriaId": "D4AB3C25-CEA8-4D66-AEE4-953C8B17911A", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*", "matchCriteriaId": "36CE5C6D-9A04-41F5-AE7C-265779833649", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*", "matchCriteriaId": "44ECF39A-1DE1-4870-A494-06A53494338D", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*", "matchCriteriaId": "71CDF29B-116B-4DE2-AFD0-B62477FF0AEB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network."}], "id": "CVE-2025-64667", "lastModified": "2026-01-02T21:15:48.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "secure@microsoft.com", "type": "Primary"}]}, "published": "2025-12-09T18:16:06.067", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64667"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-451"}], "source": "secure@microsoft.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T16:08:56.407929+00:00", "value": {"mitigation_remediation": ["Install Microsoft Exchange Server 2016 Cumulative Update\u202f23 to fix the UI spoofing flaw.", "Install Microsoft Exchange Server 2019 Cumulative Updates\u202f14 and\u202f15 to remove the vulnerability.", "Apply the Microsoft Exchange Server Subscription Edition RTM update package to correct the misrepresentation."], "summary": {"action": "Patch", "impact": "Spoofing (Impersonation)"}, "threat_synthesis": {"affected_systems": "Microsoft Exchange Server 2016 with Cumulative Update\u202f23, Microsoft Exchange Server 2019 with Cumulative Updates\u202f14 and\u202f15, and Microsoft Exchange Server Subscription Edition Release To Manufacturing are affected by the flaw.", "description_and_impact": "User interface misrepresentation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. The flaw misrepresents critical information, which could lead administrators and users to accept false data or be misled by the altered interface. While the CVE text does not explicitly state that attackers can acquire credentials, it is inferred that the spoofing could facilitate convincing a user to act on fabricated information, potentially enabling unauthorized actions.", "risk_and_exploitability": "The CVSS score is 5.3, indicating moderate severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to deliver a spoofed interface element over the network to a user; this likely requires social engineering or trust in the altered UI, making exploitation difficult. Overall risk remains moderate but active exploitation is currently unreported."}}}}, "created": "2026-04-20T16:15:11.020047+00:00", "updated": "2026-04-20T16:15:11.020057+00:00", "vendors": []}