TI-2026-72355 Aliases CVE-2026-70297 GHSA-pphw-5c3p-q633

Absolute path traversal in Skype for Business allows code execution

MEDIUM 42CWE-36Published 2026-10-13 · Updated 2026-10-31

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Skype for Business Server and Microsoft Lync contain an absolute path traversal flaw (CWE-36) that lets an authorized attacker execute code over a network. The attacker needs low privileges and no user interaction. Skype for Business Server 2015 CU13, 2019 CU8 and Subscription Edition CU1 are affected before their fixed builds.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0116 67th percentileScored 2026-11-07

Fix Fixed Skype for Business Server 2015 CU13 (Microsoft): 6.0.9319.886Skype for Business Server 2019 CU8 (Microsoft): 7.0.2046.583+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Skype for Business Server 2015 CU13	9319.0 to before 6.0.9319.886	6.0.9319.886	Patch available	CNA
Microsoft	Skype for Business Server 2019 CU8	2046.0 to before 7.0.2046.583	7.0.2046.583	Patch available	CNA
Microsoft	Skype for Business Server Subscription Edition CU1	2046.0 to before 7.0.2046.889	7.0.2046.889	Patch available	CNA

Skype for Business Server 2015 CU13 VendorMicrosoft Affected 9319.0 to before 6.0.9319.886 Fixed in 6.0.9319.886 Patch available CNA
Skype for Business Server 2019 CU8 VendorMicrosoft Affected 2046.0 to before 7.0.2046.583 Fixed in 7.0.2046.583 Patch available CNA
Skype for Business Server Subscription Edition CU1 VendorMicrosoft Affected 2046.0 to before 7.0.2046.889 Fixed in 7.0.2046.889 Patch available CNA

Remediation

Skype for Business Server 2015 CU13 is fixed in 6.0.9319.886, Skype for Business Server 2019 CU8 is fixed in 7.0.2046.583, and Skype for Business Server Subscription Edition CU1 is fixed in 7.0.2046.889.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Skype for Business Server 2015 CU13 (Microsoft) Fixed in 6.0.9319.886
Fix · CNA Skype for Business Server 2019 CU8 (Microsoft) Fixed in 7.0.2046.583
Fix · CNA Skype for Business Server Subscription Edition CU1 (Microsoft) Fixed in 7.0.2046.889

Timeline

2026-10-13 Threatist record created from CVE-2026-70297
2026-10-13 Alias added: GHSA-pphw-5c3p-q633
2026-10-14 Priority changed: LOW → MEDIUM

References

Patch 1

Skype for Business Remote Code Execution Vulnerability

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences