Actively exploited in the wild
Microsoft Skype for Business Privilege Escalation Vulnerability
Microsoft - Skype for Business · Listed in the CISA KEV since 2023-10-10. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-41763
MediumCVSS 5.3KEVSummary
Elevation of Privilege vulnerability in Skype for Business. Technical details are not available in the description.
Risk Assessment
Risk of unauthorized privilege escalation in Skype for Business environment, potentially leading to confidentiality and integrity breaches.
Recommendation
Apply security updates provided by Microsoft for Skype for Business.
Other vulnerabilities in Skype for Business
See all- CVE-2026-66302Critical
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.
- CVE-2026-69646High
Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.
- CVE-2026-69642Medium
A cross-site scripting (XSS) vulnerability in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-66308Medium
An out-of-bounds read vulnerability in Skype for Business allows an authorized attacker to deny service over a network.
- CVE-2026-66307High
Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.
- CVE-2026-66306Medium
A vulnerability in Skype for Business that generates error messages containing sensitive information allows an unauthorized attacker to disclose information over a network.
- CVE-2026-66305High
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.
- CVE-2026-66304High
Server-side request forgery (SSRF) in Skype for Business allows an unauthorized attacker to disclose information over a network.
- CVE-2026-66303Medium
A null pointer dereference vulnerability in Skype for Business allows an authorized attacker to deny service over a network.
- CVE-2026-63523Medium
A cross-site scripting (XSS) vulnerability in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
Original NVD description (English source)
Skype for Business Elevation of Privilege Vulnerability