Main Vulnerability Database Vulnerabilities #VU53102

Code Injection in Microsoft Lync and Skype for Business Server - CVE-2021-26422

Published: May 11, 2021

Vulnerability identifier: #VU53102

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-26422

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Skype for Business and Lync. A remote administrator can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Microsoft Lync
Skype for Business Server

How to mitigate CVE-2021-26422

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26422

Related Security Bulletins