MSRC-CVE-2026-85873 — Skype for Business Elevation of Privilege Vulnerability

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What type of information could be disclosed by this vulnerability?
An authenticated attacker could manipulate a download request sent to an affected Skype for Business server to read the contents of arbitrary files on the system. Successful exploitation could disclose the contents of sensitive files.

Security updates
7.0.2046.889 — https://support.microsoft.com/help/5131692
7.0.2046.583 — https://support.microsoft.com/help/5131693
6.0.9319.886 — https://support.microsoft.com/help/5132779

Vulnerabilities 1

Medium 6.5

CVE-2026-85873

Skype for Business Elevation of Privilege Vulnerability

Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.

Microsoft Skype for Business Server 2015 CU13 Skype for Business Server 2019 CU8 Skype for Business Server Subscription Edition CU1

Oct 13, 2026

Revision history

2026-10-13 #1
Information published.

References

CVE-2026-85873 Skype for Business Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85873
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss