CVE-2026-85873: Skype for Business Elevation of Privilege Vulnerability

Overview

Severity

Medium (CVSS 6.5)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Category

Elevation of Privilege

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Oct

Released

2026-10-13

Description

Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.

FAQ

What type of information could be disclosed by this vulnerability? An authenticated attacker could manipulate a download request sent to an affected Skype for Business server to read the contents of arbitrary files on the system. Successful exploitation could disclose the contents of sensitive files.

Affected Products (4)

Microsoft Office

• Skype for Business Server Subscription Edition CU1
• Skype for Business Server 2019 CU8
• Skype for Business Server 2015 CU13

Other

• Skype for Business Server Subscription Edition RTM

Security Updates (1)

• 5131692

Acknowledgments

Anonymous

Revision History

• 2026-10-13: Information published.