EUVD-2026-100142
GHSA-6286-h9rv-4j7m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
DeliverySend crafted network request with manipulated object identifier
-
ExploitBypass improper authorization check
-
ExecutionAccess higher-privileged data or capabilities
-
ImpactElevate effective privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires the attacker to already be an authenticated/authorized user on an affected Skype for Business Server (Subscription Edition pre-7.0.2046.889, 2015 CU13 pre-6.0.9319.886, 2019 CU8 pre-7.0.2046.583) or Microsoft Lync deployment (PR:L) - it is NOT a pre-auth remote bug. No user interaction, no special non-default configuration, and no local access are indicated; the flaw is reachable over the network against the running server. The principal limiting factor is the authentication prerequisite: an attacker must possess valid low-privilege credentials or an account, which constrains this to insiders or attackers who have already gained a foothold, rather than anonymous internet-wide exploitation. |
| Impact | This is a moderate-severity (CVSS 6.5) improper-authorization flaw (CWE-639, IDOR-class) in Skype for Business Server and the legacy Microsoft Lync product. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity attack requiring an already-authenticated (PR:L) actor and no user interaction, yielding high confidentiality impact but no integrity or availability impact. Multiple signals converge to downgrade real-world urgency: CISA SSVC reports Exploitation=none and Automatable=no, there is no CISA KEV listing, and no public exploit code is referenced - so there is no public exploit identified at time of analysis. SSVC Technical Impact is rated 'total,' which sits in tension with the CVSS impact set (C:H but I:N/A:N); this likely reflects SSVC scoring the component's full compromise potential rather than this specific metric's confidentiality-only reading. There is also a conceptual mismatch worth flagging: the title says 'elevate privileges' (EoP), yet the CVSS models confidentiality-only impact - verify with Microsoft whether elevated privileges also enable integrity-affecting actions. Net: a real but not emergency priority - patch in normal cycle; the PR:L prerequisite (attacker must already hold valid credentials/an account on the system) and absence of exploitation evidence keep this below drop-everything status. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authenticated account on a Skype for Business / Lync deployment sends crafted network requests that reference objects or identifiers belonging to other users or higher-privileged contexts. Because authorization is improperly enforced (CWE-639), the server returns data the attacker should not be able to access, elevating their effective privileges. No user interaction is required, but no public proof-of-concept or active exploitation has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Improper authorization (CWE-639, an IDOR-class flaw) in Skype for Business Server and the legacy Microsoft Lync product lets an authenticated, low-privilege user reach data or functionality that should be reserved for other users or higher-privileged roles, resulting in unauthorized disclosure of sensitive information over the network (CVSS 6.5, C:H/I:N/A:N). The affected deployments are Skype for Business Server Subscription Edition before 7.0.2046.889, Skype for Business Server 2019 CU8 before 7.0.2046.583, and Skype for Business Server 2015 CU13 before 6.0.9319.886; Microsoft has published fixes for all three. The flaw is not remotely exploitable by anonymous attackers, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', so risk is concentrated in environments where low-privileged accounts exist and the server is broadly reachable.
RemediationAI
Vendor-released patch: Microsoft has fixed this issue in Skype for Business Server Subscription Edition 7.0.2046.889 and later, Skype for Business Server 2019 CU8 7.0.2046.583 and later, and Skype for Business Server 2015 CU13 6.0.9319.886 and later - apply the corresponding cumulative update from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85873 and verify the reported build number after installation. Environments still running Lync Server or end-of-support Skype for Business builds should treat this as a migration trigger, since no back-ported fix should be assumed for unsupported branches. Because exploitation requires valid low-privilege credentials, the most effective compensating controls are containment of the credential surface and the attack surface: enforce MFA and conditional access for all on-premises account sign-ins, sweep for stale, shared, or unnecessary low-privilege service and conferencing accounts (the trade-off being added onboarding friction and potential disruption of automated integrations), and restrict reachability of the server's HTTPS web-services and SIP/TLS endpoints to trusted networks or VPN rather than the public internet (which breaks external or federated client access unless a reverse proxy or edge role is used instead). Until patching completes, increase logging and review of cross-user object access through the platform's web services, and segment the deployment so a compromised standard user cannot reach administrative or privileged mailboxes; note that these controls reduce exposure but do not remove the underlying authorization bypass, so patching remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Skype for Business Server (the successor to Microsoft Lync Server) is an on-premises unified communications platform whose front-end role exposes SIP/TLS signaling plus an HTTPS web-services stack (autodiscovery, Web Ticket authentication, conferencing and address-book services) fronting a backend SQL Server configuration and user store. The defect is classified as CWE-639, Authorization Bypass Through User-Controlled Key - the classic insecure direct object reference pattern in which a request carries an identifier (meeting, user, or resource key) supplied by the caller and the server resolves that key without verifying that the authenticated principal is entitled to the referenced object. Consequently a valid low-privilege account can pivot to another user's or a higher-privileged user's data, giving the confidentiality-only impact reflected in the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N: the attack is network-reachable (AV:N) with low complexity (AC:L) and no user interaction (UI:N), scope is unchanged (S:U), and only confidentiality is impacted (C:H, I:N, A:N). The single meaningful barrier is the PR:L authentication prerequisite, which places this in the post-compromise or insider threat class rather than the pre-auth internet-wide class. The issue is tracked by ENISA as EUVD-2026-100142 and is a server-side authorization-enforcement defect, not a memory-safety, cryptographic, or configuration-hardening bug.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable (AV:N) with low complexity, but requires an existing authorized account (PR:L); improper authorization exposes other users' data (C:H) with no proven integrity/availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB