CVE‑2026‑85873 describes an improper authorization flaw in Microsoft Skype for Business Server where an attacker who is already authenticated can elevate privileges over the network. The vulnerability allows the attacker to manipulate or access privileged actions that should be restricted, potentially compromising configuration settings, data, or service functionality. The weakness follows CWE‑639, which indicates the failure to enforce proper authorization checks.

The flaw affects Microsoft Skype for Business Server 2015 CU13, 2019 CU8, Subscription Edition CU1, and Subscription Edition RTM. All listed versions were identified through CNA vendor/product data and the Microsoft update guide. No other versions are currently reported as affected.

The CVSS base score is 6.5, indicating a medium to high severity risk. EPSS data is not available, so the contemporary likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Because the issue relies on an authorized attacker already being able to connect to the server, the attack vector would require network access to the Skype for Business servers and the compromise of an authenticated account. If an attacker achieves the migration, they can execute privileged commands that could lead to unauthorized changes or data exposure, though full system compromise would demand additional steps beyond this elevation alone.