CVE-2026-85873: Skype for Business Privilege Escalation

CVE-2026-85873 Overview

CVE-2026-85873 is an improper authorization vulnerability affecting Microsoft Skype for Business and Microsoft Lync. The flaw permits an authenticated attacker to elevate privileges over a network. The weakness is categorized under [CWE-639] (Authorization Bypass Through User-Controlled Key), indicating the server trusts a client-supplied identifier when enforcing access decisions. Successful exploitation yields a high confidentiality impact without affecting integrity or availability of the target system. Microsoft published the advisory in the Security Update Guide, and the vulnerability requires low-privilege authentication to exploit.

Critical Impact
An authenticated attacker can abuse improper authorization checks in Skype for Business and Microsoft Lync to access data belonging to other users across the network.

Affected Products

Microsoft Skype for Business
Microsoft Lync
Refer to the Microsoft Security Update Guide for specific affected builds

Discovery Timeline

2026-10-13 - CVE-2026-85873 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85873

Vulnerability Analysis

The vulnerability stems from improper authorization logic within Skype for Business and Microsoft Lync server components. The affected code paths rely on client-controlled identifiers when deciding whether a requesting principal may access a resource. An attacker who already holds valid credentials can manipulate those identifiers to reference objects owned by other users. The server then returns protected content without re-validating the caller's effective permissions.

The CVSS vector indicates the attack is network-reachable, has low complexity, requires low privileges, and needs no user interaction. The confidentiality impact is high, while integrity and availability are not affected. This profile is consistent with a privilege escalation that exposes sensitive data such as meeting content, presence information, or user records.

Root Cause

The root cause maps to [CWE-639]: Authorization Bypass Through User-Controlled Key. The server component accepts an identifier supplied in the request and uses it as the sole basis for object retrieval. The authorization layer does not independently verify that the authenticated session owns, or has delegated rights over, the referenced object. This design permits horizontal and vertical privilege escalation depending on the resource targeted.

Attack Vector

An attacker first authenticates with any valid account on the targeted Skype for Business or Lync deployment. The attacker then issues crafted requests to protected endpoints while substituting the object identifier of another user. Because the server does not re-check ownership, it discloses the targeted data to the attacker.

No public proof-of-concept code is available for this issue. See the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-85873

Indicators of Compromise

Authenticated sessions issuing high volumes of requests that reference identifiers belonging to other users or tenants.
Access patterns where a single account retrieves resources associated with many unrelated accounts in a short window.
Server logs showing successful responses to requests that cross organizational unit or role boundaries.

Detection Strategies

Baseline normal object-access patterns per user and alert on deviations such as sudden fan-out across unrelated identifiers.
Correlate authentication events with downstream resource access to flag low-privileged accounts accessing privileged data.
Review Skype for Business and Lync server logs for repeated requests that enumerate sequential or guessable object IDs.

Monitoring Recommendations

Forward Skype for Business and Lync application and IIS logs to a centralized analytics platform for behavioral analysis.
Monitor for atypical API usage by service accounts and newly provisioned users.
Alert on administrative data access initiated by non-administrative principals.

How to Mitigate CVE-2026-85873

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is available for your deployment.
Audit Skype for Business and Lync accounts, disabling stale or unused credentials that could serve as the required low-privilege foothold.
Review recent access logs for signs of cross-user data retrieval predating the patch.

Patch Information

Microsoft has published advisory information in the Security Update Guide for CVE-2026-85873. Administrators should consult the Microsoft Security Update Guide to identify the specific update packages that apply to their Skype for Business Server and Microsoft Lync deployments and schedule patch deployment accordingly.

Workarounds

Restrict network reachability of Skype for Business and Lync servers to trusted corporate networks and VPN clients.
Enforce multi-factor authentication to raise the cost of obtaining the authenticated access the attack requires.
Limit account provisioning and tighten least-privilege policies until patching is complete.

bash

# Example: restrict inbound access to Skype for Business front-end services
# using Windows Firewall advanced rules (adjust ports and scopes to your environment)
New-NetFirewallRule -DisplayName "SfB-Restrict-FrontEnd" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 443,5061 `
  -RemoteAddress 10.0.0.0/8,192.168.0.0/16 `
  -Action Allow