CVE-2021-26422 Skype for Business and Lync Remote Code Execution Vulnerability
An attacker can execute arbitrary code on Microsoft Skype for Business and Lync servers, requiring immediate patching by administrators.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-26422?
CVE-2021-26422 is a high-severity code injection vulnerability in Microsoft Lync Server 2013 CU10, published on 11 May 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Skype for Business and Lync Remote Code Execution Vulnerability
Which versions are affected by CVE-2021-26422?
It affects 2 products.
Products include Microsoft Lync Server, Microsoft Skype for Business Server.
How do I fix CVE-2021-26422?
No fix has been published for CVE-2021-26422 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-26422 being exploited?
There is no known exploitation of CVE-2021-26422 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Lync Server 2013 CU10
- CVE-2022-33633 Skype for Business and Lync Remote Code Execution Vulnerability
- CVE-2022-26911 Skype for Business Information Disclosure Vulnerability
- CVE-2021-26421 Skype for Business and Lync Spoofing Vulnerability
- CVE-2021-24073 Skype for Business and Lync Spoofing Vulnerability
- CVE-2021-24099 Skype for Business and Lync Denial of Service Vulnerability
Sources
Also known as GHSA-322h-m7q9-7x4q.