The Exchange product group released the August 2025 Hotfix Updates for Exchange Server SE, Exchange Server 2019, and Exchange Server 2016. The SU for SE comes barely a month after the RTM release of Exchange SE RTM.

The vulnerabilities addressed in these Security Updates for Exchange Server are:

Vulnerability	Category	Severity	Rating
CVE-2025-25005	Tampering	Important	CVSS:3.1 6.5 / 5.7
CVE-2025-25006	Spoofing	Important	CVSS:3.1 5.3 / 4.6
CVE-2025-25007	Spoofing	Important	CVSS:3.1 5.3 / 4.6
CVE-2025-33051	Information Disclosure	Important	CVSS:3.1 7.5 / 6.5

The Security Updates for each supported Exchange Server build are linked below:

Exchange	SU	Download	Build	KB	Supersedes
Exchange SE	1	Download	15.2.2562.20	KB5063224
Exchange 2019 CU15	3	Download	15.2.1748.36	KB5063221	KB5049233
Exchange 2019 CU14	6	Download	15.2.1544.33	KB5063222	KB5049233
Exchange 2016 CU23	17	Download	15.1.2507.58	KB5063223	KB5049233

Feature Changes

The November SUs for Exchange 2019 and Exchange 2016 introduced AMSI integration. AMSI was disabled by default after deploying this SU. Now, with the August 2025 SUs, AMSI body scanning will be enabled for all protocols. Consult the documentation on how to disable AMSI scanning should you encounter any issues.

Fixed Issues

Apart from security fixes and added features, these Security Updates also correct the following issues:

Issue Fixed
Exchange Server fails to export eDiscovery search results to a discovery mailbox
Application pools stop responding and performance is affected after MSIPC is enabled
Incorrect ACE is modified through public folder management in Outlook​​​​​​​​​​​​​​

Notes

• Security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2019 CU15 to Exchange 2019 CU14. When downloading, the security update might carry the same name for different Cumulative Updates. Nowadays, Microsoft adds the KB article number as reference, but I would still tag the file name with the CU level for archival purposes, e.g., Exchange2019-CU15-KB5063221-x64-en.exe.
• Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
• Suppose you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management. In that case, it is recommended that you apply the Security Update.

On a final note, as with any patch or update, it is recommended that you apply it in a test environment before implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it comes to security updates and follow a more agile approach; the ratings indicate the level of urgency.