CVE-2026-85873: Skype for Business Elevation of Privilege Vulnerability
Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
Other sources
Skype for Business Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.9319.886Patch KB5132779 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.583Patch KB5131693 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.889 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.889Patch KB5131692
Event History
Frequently Asked Questions
Which deployments are identified as affected?
The listed affected products are Microsoft Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU8, Skype for Business Server Subscription Edition RTM, and Skype for Business Server Subscription Edition CU1.
What access does an attacker need to exploit this issue?
The attacker must already be authorized and able to reach the affected service over the network. No user interaction is required.
What is the expected security impact?
The vulnerability can result in privilege elevation and has a high confidentiality impact. The supplied metrics indicate no integrity or availability impact.