The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the August, 2025 security bulletin.

  - Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an     unauthorized attacker to disclose information over a network. (CVE-2025-33051)

  - Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering     over a network. (CVE-2025-25005)

  - Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized     attacker to perform spoofing over a network. (CVE-2025-25006)

  - Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized     attacker to perform spoofing over a network. (CVE-2025-25007)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Security Updates for Microsoft Exchange Server (August 2025)

high Nessus Plugin ID 249140

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Sep 27, 2025, 7:42 AM CVSSv3 score source (Adjusted target CVE) Plugin metadata (Updated to remove references to CVE-2025-53786) Plugin Feed: 202509270742
Version 1.3 Sep 17, 2025, 9:12 PM New Plugin Feed: 202509172112
Version 1.2 Aug 15, 2025, 7:38 PM New Plugin Feed: 202508151938
Version 1.1 Aug 13, 2025, 7:42 PM New Plugin Feed: 202508131942