The Exchange product group released the December 2025 Security Update for Exchange Server SE. Organizations that enrolled in the Extended Security Update program will also have access to December 2025 security updates for Exchange Server 2019 and Exchange Server 2016. These ESU updates will not be made available publicly.
The vulnerabilities addressed in these Security Updates for Exchange Server are:
| Vulnerability | Category | Severity | Rating |
|---|---|---|---|
| CVE-2025-64666 | Elevation of Privilege | Important | CVSS:3.1 7.5 / 6.5 |
| CVE-2025-64667 | Spoofing | Important | CVSS:3.1 5.3 / 4.6 |
The Security Updates for each supported Exchange Server build are linked below:
| Exchange | SU/HU | Download | Build | KB | Supersedes |
|---|---|---|---|---|---|
| Exchange SE | 4 | Download | 15.2.2562.29 | KB5071876 | KB5066366 |
| Exchange 2019 CU15 | 6 | ESU Program | 15.2.1748.42 | KB5071875 | KB5066367 |
| Exchange 2019 CU14 | 9 | ESU Program | 15.2.1544.37 | KB5071874 | KB5066368 |
| Exchange 2016 CU23 | 20 | ESU Program | 15.1.2507.63 | KB5071873 | KB5066369 |
Fixed Issues
The issue addressed in these hotfixes is:
Notes
- Security updates are Cumulative Update level specific. You cannot apply the Exchange 2019 CU15 update to Exchange 2019 CU14. When downloading, the security update might carry the same name for different Cumulative Updates. Nowadays, Microsoft adds the KB article number as a reference, but I would still tag the file name with the CU level for archival purposes, e.g., Exchange2019-CU15-KBxxxxxxx-x64-en.exe.
- Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
- Suppose you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management. In that case, it is recommended that you apply the Security Update.
On a final note, as with any patch or update, it is recommended that you apply it in a test environment before implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it comes to security updates; a more agile approach is preferable, and the ratings indicate the level of urgency.
Hi Michel,
For Exchange SE : The download link points to the August update.
This is the good link : https://www.microsoft.com/en-us/download/details.aspx?id=108493
Ugh, thanks