Vulnerability record · CVE-2023-41763 · published 10 October 2023
CVE-2023-41763: Microsoft Skype for Business Server SSRF Elevation of Privilege
Microsoft · Skype For Business Server
CVE-2023-41763 is a server-side request forgery (CWE-918) flaw in Microsoft Skype for Business Server, rated by Microsoft as an elevation of privilege issue. The CVSS 3.1 base score is 5.3 (MEDIUM) with a network vector and no privileges or user interaction required. Because it is listed in CISA's Known Exploited Vulnerabilities catalog, it matters despite the moderate score.
Description
Skype for Business Elevation of Privilege Vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Automated analysis
high priorityAlthough CVSS is only 5.3 (MEDIUM), the flaw is in CISA's KEV catalog with confirmed in-the-wild exploitation and an EPSS probability above 0.90.
What it is
CVE-2023-41763 is a server-side request forgery (CWE-918) flaw in Microsoft Skype for Business Server, rated by Microsoft as an elevation of privilege issue. The CVSS 3.1 base score is 5.3 (MEDIUM) with a network vector and no privileges or user interaction required. Because it is listed in CISA's Known Exploited Vulnerabilities catalog, it matters despite the moderate score.
Impact
An unauthenticated network attacker can induce the server to make requests on their behalf, yielding limited confidentiality impact (C:L) per the CVSS vector. The record does not describe further consequences such as code execution or data modification.
Attack surface
Reachable over the network (AV:N) with low attack complexity and no authentication (PR:N) or user interaction (UI:N) required, per the CVSS vector. The description does not identify the specific endpoint or component involved.
Exploitation
CISA added it to the KEV catalog on 2023-10-10 with a remediation due date of 2023-10-31, indicating known exploitation in the wild. EPSS is very high at 0.90353 (99.792nd percentile), and no ransomware campaign use is recorded.
What to do
- Apply the Microsoft patch referenced in the MSRC update guide for CVE-2023-41763 as the first action.
- If patching is not possible, follow CISA's required action: apply vendor mitigations or discontinue use of the product.
- Restrict network exposure of Skype for Business Server to trusted networks and required clients only.
- Monitor outbound requests originating from Skype for Business Server hosts for unexpected destinations.
Detection
- Review Skype for Business Server logs for anomalous or unexpected outbound HTTP/HTTPS requests indicative of SSRF.
- Monitor network egress from Skype for Business Server hosts for connections to untrusted or internal-only addresses.
- Alert on exploitation attempts against Skype for Business Server endpoints using vendor or public indicators where available.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2023-41763 to the Known Exploited Vulnerabilities catalog on 10 October 2023 as "Microsoft Skype for Business Privilege Escalation Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 31 October 2023.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763 | PatchVendor Advisory |
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763 | PatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763 | US Government Resource |
Track CVE-2023-41763 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-41763), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
