The Cybersecurity and Infrastructure Security Agency has issued Emergency Directive 25-02 to address a security flaw that could affect hybrid Microsoft Exchange users. The agency said Thursday that it is ordering federal agencies to respond to the risk by using Microsoft’s mitigation instructions.
The post-authentication vulnerability could allow hackers with administrative access to the Microsoft Exchange email server to gain more control and break into connected cloud systems. The agency has yet to find an attacker who uses the flaw to exploit its system, but the new common vulnerabilities and exposure, identified as CVE-2025-53786, could compromise its administrative controls over cloud services if it is left unresolved.
Join the Potomac Officers Club 2025 Homeland Security Summit on November 12 and learn about the Department of Homeland Security’s programs and strategic initiatives. Gain further insights on how the DHS counters the most critical threats, how it integrates artificial intelligence in its operations and more!
CISA’s Madhu Gottumukkala Shares Thoughts
Commenting on the security risk, CISA Acting Director Madhu Gottumukkala said the agency is “taking urgent action to mitigate this vulnerability that poses a significant, unacceptable risk to the federal systems upon which Americans depend.”
“The risks associated with this Microsoft Exchange vulnerability extend to every organization and sector using this environment. While federal agencies are mandated, we strongly urge all organizations to adopt the actions in this Emergency Directive,” he added.
Related Articles
Gregory Barbaccia, federal chief information officer and a 2025 Wash100 awardee, has shared his insights on how the federal government should advance digital transformation. “I notice a lot of the government considers itself to be ‘digital,’ but in reality, we’ve only digitized, not transformed. Sure we went 0-1, but that should have just been the beginning,” Barbaccia wrote in a LinkedIn post. He noted the lack of automation and that workflows remain unchanged despite the replacement of paper ledgers with spreadsheets. “Files are shared over email instead of through real-time collaboration tools,” he added. Advancing Digital Transformation in Federal Government
The Federal Communications Commission has adopted new rules that seek to eliminate unnecessary paperwork and address regulatory barriers to the ground-station-as-a-service, or GSaaS, business model as part of efforts to drive innovation in the U.S. space economy. FCC said Thursday the new rules establish a process for ground station operators to secure a baseline license without first identifying a satellite point of communication. A simple FCC notification will be required for each new point of communication. According to FCC, the change would eliminate nearly half of earth station modification applications. “Making the smallest change to a satellite system or earth
The General Services Administration has announced a OneGov agreement with Amazon Web Services that will provide up to $1 billion in direct incentive credits to federal civilian agencies. According to GSA, the direct incentive credits, aggregated across the agencies, will include savings on core AWS cloud services through AWS credits, infrastructure and application technologies modernization through AWS modernization credits, access to AWS training and certification through training credits and a streamlined engagement model with greater savings for direct contracts through direct partnerships. Advancing America’s AI Leadership The agreement is expected to accelerate large-scale IT transformation and boost AI innovation across