What’s Vulnerable › Vulnerabilities

CVE-2017-11786

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-10-13 · updated 2026-06-17
• Weakness: CWE-294

Description

Skype for Business in Microsoft Lync 2013 SP1 and Skype for Business 2016 allows an attacker to steal an authentication hash that can be reused elsewhere, due to how Skype for Business handles authentication requests, aka "Skype for Business Elevation of Privilege Vulnerability."

Affected products

• Microsoft Lync Server: 2013-sp1
• Microsoft Skype for Business Server 2019 CU2: 2016
• Microsoft Skype for Business Server 2019 CU2: Microsoft Lync 2013 SP1 and Skype for Business 2016

References

• http://www.securityfocus.com/bid/101156
• http://www.securitytracker.com/id/1039530
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11786
• http://www.securityfocus.com/bid/101156
• http://www.securitytracker.com/id/1039530
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11786

Get alerted when CVE-2017-11786 or the next vulnerability affects your stack