CVE-2026-85873: medium-severity vulnerability in Microsoft Skype for Business Server 2015 CU13
Skype for Business Elevation of Privilege Vulnerability
Published
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5
exploitation probability
—
observed exploitation
nono source reports it
Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Affected products
Microsoft · Skype for Business Server 2015 CU13Microsoft · Skype for Business Server 2019 CU8Microsoft · Skype for Business Server Subscription Edition CU1Microsoft · Skype for Business Server Subscription Edition RTMRelated CVEs — Microsoft Skype for Business Server 2015 CU13
In the same product, most dangerous first.
CVE-2023-41763MEDIUMSkype for Business Elevation of Privilege VulnerabilityEPSS 90.5%KEVCVE-2023-36780HIGHSkype for Business Remote Code Execution VulnerabilityEPSS 2.7%CVE-2023-36786HIGHSkype for Business Remote Code Execution VulnerabilityEPSS 2.6%CVE-2023-36789HIGHSkype for Business Remote Code Execution VulnerabilityEPSS 2.5%CVE-2026-66307HIGHSkype for Business and Lync Denial of Service VulnerabilityEPSS 1.2%CVE-2026-66303MEDIUMSkype for Business and Lync Denial of Service VulnerabilityEPSS 1.1%