Privilege Elevation in Skype for Business by Microsoft
CVE-2026-85873

6.5MEDIUM

Key Information:

Vendor

Microsoft
Status
Skype For Business Server 2015 Cu13
Skype For Business Server 2019 Cu8
Skype For Business Server Subscription Edition Cu1
Vendor
CVE Published:
13 October 2026

What is CVE-2026-85873?

An improper authorization vulnerability in Skype for Business and Microsoft Lync enables an attacker with valid credentials to gain elevated privileges within a network. This flaw poses a significant risk as it could allow unauthorized actions that compromise system integrity and confidentiality. Mitigation steps include applying the latest security patches and implementing strict access controls to limit unnecessary privileges.

Affected Version(s)

Skype for Business Server 2015 CU13 x64-based Systems 9319.0 < 6.0.9319.886

Skype for Business Server 2019 CU8 x64-based Systems 2046.0 < 7.0.2046.583

Skype for Business Server Subscription Edition CU1 x64-based Systems 2046.0 < 7.0.2046.889

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.