CVE-2026-85873

MediumCVSS 6.5

Published: 13/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.82%

57th percentile - higher than 57% of all known CVEs

Summary

Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network. The vulnerability enables privilege escalation within the application context.

Risk Assessment

An attacker with network access could elevate their privileges, potentially leading to control over the system or data. However, valid credentials are required.

Recommendation

Urgently apply patches for Skype for Business and Microsoft Lync and review authorization mechanisms.

Other vulnerabilities in Skype for Business and Microsoft Lync

CVE-2026-83746High
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network. The flaw enables bypassing path restrictions and gaining higher privileges remotely.

Original NVD description (English source)

Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS