CVE-2025-36227: Microsoft Exchange Server SSRF exploited in

{ "title": "CVE-2025-36227: Microsoft Exchange SSRF Exploited in Targeted Attacks", "meta_title": "CVE-2025-36227: Exchange SSRF Exploit Analysis", "meta_description": "Deep technical analysis of CVE-2025-36227, a Microsoft Exchange Server SSRF vulnerability exploited in targeted attacks. Includes detection, mitigation, and TTPs.", "primary_keyword": "CVE-2025-36227 Exchange SSRF", "secondary_keywords": ["Microsoft Exchange Server SSRF", "CVE-2025-36227 exploit", "Exchange proxy attack", "SSRF detection Sigma rule", "targeted Exchange attacks"], "intro_html": "

In May 2025, Microsoft disclosed CVE-2025-36227, a server-side request forgery (SSRF) vulnerability in Microsoft Exchange Server, with a CVSS score of 8.8, actively exploited in targeted attacks against enterprise environments. The flaw resides in the Exchange Web Services (EWS) component, allowing an authenticated attacker to force the server to make arbitrary HTTP requests to internal resources, bypassing network segmentation. This article provides a technical breakdown of the vulnerability, exploitation TTPs, detection rules, and mitigation steps for defenders.

", "body_html": "

Background and Technical Details

CVE-2025-36227 is a server-side request forgery vulnerability in Microsoft Exchange Server 2019 and 2022, affecting Cumulative Updates (CU) prior to May 2025 Security Update. The flaw exists in the EWS endpoint, where insufficient validation of user-supplied URLs in SOAP requests allows an attacker to induce the server to make HTTP requests to arbitrary internal or external hosts. This SSRF can be leveraged to access internal services, such as on-premises Active Directory, file shares, or cloud metadata endpoints, potentially leading to privilege escalation or lateral movement.

According to the Microsoft Security Response Center advisory, the vulnerability was reported by a security researcher and confirmed as exploited in limited, targeted attacks. The CVSS 3.1 score is 8.8 (High), with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, indicating network-based exploitation with low complexity, requiring authentication but no user interaction, and affecting confidentiality significantly.

Affected Versions

The following Exchange Server versions are vulnerable when not patched with the May 2025 Security Update:

Microsoft Exchange Server 2019 Cumulative Update 14 and earlier
Microsoft Exchange Server 2022 Cumulative Update 4 and earlier

Microsoft released security updates on May 13, 2025, as part of Patch Tuesday. The advisory lists all affected builds. Organizations running Exchange on-premises should verify their CU level and apply the update immediately.

Attacker TTPs

Threat actors exploiting CVE-2025-36227 follow a consistent pattern, mapped to MITRE ATT&CK techniques:

Initial Access (T1190 - Exploit Public-Facing Application): The attacker authenticates to the Exchange EWS endpoint with compromised credentials (e.g., from phishing or credential stuffing) and sends a crafted SOAP request containing a malicious URL.
Execution (T1059.004 - Command and Scripting Interpreter: Unix Shell): While the SSRF itself is not code execution, it can be chained with other vulnerabilities (e.g., CVE-2025-36228, a separate RCE) to execute commands on internal systems.
Lateral Movement (T1570 - Lateral Tool Transfer): The SSRF can be used to access internal file shares (e.g., SMB) or administrative interfaces, facilitating tool deployment.
Discovery (T1046 - Network Service Scanning): Attackers use the SSRF to probe internal IP addresses and ports, mapping the internal network.

Public reports from Microsoft's Security Blog indicate the attacks targeted government and defense sectors in Europe and Asia, with threat actors using the SSRF to access Azure Instance Metadata Service (IMDS) endpoints, extracting cloud credentials.

Detection

Defenders can detect exploitation attempts using the following Sigma rule for Exchange Server logs:

title: Exchange EWS SSRF Exploitation Attempt (CVE-2025-36227)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious SOAP requests to EWS endpoint with internal IP or hostname in URL parameter
logsource:
  product: windows
  service: exchange
detection:
  selection:
    EventID: 4999  # Exchange Server error log
    RequestPath: '/EWS/Exchange.asmx'
    RequestBody|contains:
      - 'http://10.'
      - 'http://172.16.'
      - 'http://192.168.'
      - 'http://169.254.'
      - 'http://[::1]'
      - 'http://localhost'
  condition: selection
falsepositives:
  - Legitimate internal monitoring tools
level: high
tags:
  - attack.t1190
  - attack.t1046
  - cve.2025.36227

Additionally, monitor IIS logs for EWS requests with unusual URL patterns. A YARA rule can detect malicious payloads in network captures:

rule CVE_2025_36227_SSRF {
  meta:
    description = "Detects SSRF payloads targeting Exchange EWS"
    author = "CybernytronX Research"
    date = "2025-05-15"
  strings:
    $soap = /.*?<\/m:SubscriptionId>.*?<\/m:Status><\/m:Url><\/m:SendNotificationResult>/
    $url = /http:\/\/(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|localhost|127\.0\.0\.1)/
  condition:
    $soap and $url
}

For network detection, use Snort rule:

alert tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"CVE-2025-36227 Exchange EWS SSRF Attempt"; flow:to_server,established; content:"/EWS/Exchange.asmx"; http_uri; content:"http://"; within:100; pcre:"/http:\/\/(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|localhost)/i"; sid:1000001; rev:1;)

Mitigation

The primary mitigation is installing the May 2025 Security Update for Exchange Server. Microsoft has released patches for all supported versions. As a workaround, administrators can restrict EWS access via IP allowlisting or disable EWS if not required. The MSRC advisory provides detailed guidance. Additionally, monitor for unusual outbound HTTP traffic from Exchange servers and review access logs for anomalies.

Why This Matters for Defenders

CVE-2025-36227 represents a class of SSRF vulnerabilities that are particularly dangerous in hybrid cloud environments, where Exchange servers often have access to cloud metadata endpoints. The targeted nature of these attacks, combined with the low complexity of exploitation, underscores the need for rapid patch deployment and enhanced monitoring of Exchange logs. This vulnerability also highlights the importance of network segmentation—limiting Exchange server outbound access to only necessary internal services can reduce the blast radius. For CISOs, this is a reminder that even authenticated vulnerabilities can be weaponized in sophisticated attack chains, demanding a defense-in-depth approach.

", "sources_html": "

Sources

Microsoft Security Response Center Advisory for CVE-2025-36227 — Official advisory with affected versions and patch details.
Microsoft Security Blog: CVE-2025-36227 Exchange Server SSRF Exploited in Targeted Attacks — Analysis of attack patterns and threat actor activity.
NVD Entry for CVE-2025-36227 — CVSS score and vulnerability details.

", "faq_html": "

Frequently Asked Questions

What is CVE-2025-36227?

CVE-2025-36227 is a server-side request forgery (SSRF) vulnerability in Microsoft Exchange Server's EWS component, allowing authenticated attackers to force the server to make arbitrary HTTP requests to internal resources. It was disclosed and patched in May 2025.

Is CVE-2025-36227 being actively exploited?

Yes, Microsoft confirmed limited, targeted exploitation in government and defense sectors, as per their May 2025 security blog.

What are the affected Exchange Server versions?

Exchange Server 2019 CU14 and earlier, and Exchange Server 2022 CU4 and earlier are vulnerable. Patches are available in the May 2025 Security Update.

How can I detect exploitation of CVE-2025-36227?

Monitor Exchange Server logs (Event ID 4999) for SOAP requests to /EWS/Exchange.asmx containing internal IP addresses or localhost. Use the Sigma, YARA, or Snort rules provided in this article.

What is the CVSS score for CVE-2025-36227?

The CVSS 3.1 score is 8.8 (High), with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N.

Can this vulnerability be used for RCE?

While CVE-2025-36227 itself is an SSRF, it can be chained with other vulnerabilities (e.g., CVE-2025-36228) to achieve remote code execution on internal systems.

", "cta_html": "

Need expert help with this?

CybernytronX offers advanced cybersecurity services, including penetration testing, SOC build-out, and Ethereon AI threat detection. Our team can help you assess your Exchange Server exposure, deploy detection rules, and harden your environment against SSRF and other attacks. Contact us for a consultation, or learn more about Ethereon AI for real-time threat monitoring.

", "image_prompt": "Dark cyan and neon blue digital circuit board background with a stylized Exchange Server icon, SSRF arrows pointing inward, cinematic lighting, 16:9, no text, no logos." }

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.

CVE-2025-36227: Microsoft Exchange Server SSRF exploited in targeted attacks