Authorization bypass through user-controlled key in Microsoft products - CVE-2026-85873
Published: October 14, 2026
Vulnerability identifier: #VU155215
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85873
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read arbitrary files on the system.
The vulnerability exists due to improper authorization in Skype for Business and Microsoft Lync when handling download requests. A remote user can manipulate a download request sent to an affected server to read arbitrary files on the system.
Affected software
Skype for Business Server
Skype for Business Server Subscription Edition RTM
Skype for Business Server Subscription Edition
Skype for Business Server Subscription Edition RTM
Skype for Business Server Subscription Edition
How to mitigate CVE-2026-85873
Install security update from vendor's website.
Skype for Business Server - addressed in versions 6.0.9319.886, 7.0.2046.583
Skype for Business Server Subscription Edition RTM - update to 7.0.2046.889
Skype for Business Server Subscription Edition - update to 7.0.2046.889
Skype for Business Server Subscription Edition RTM - update to 7.0.2046.889
Skype for Business Server Subscription Edition - update to 7.0.2046.889