TI-2026-72517 Aliases CVE-2026-83746 GHSA-69h8-r8mw-xc99

Skype for Business path traversal allows privilege elevation

MEDIUM 40CWE-36Published 2026-10-13 · Updated 2026-10-31

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Microsoft Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU8 and Skype for Business Server Subscription Edition CU1 are affected, and the source also names Microsoft Lync. An absolute path traversal flaw (CWE-36) lets an authorized attacker with low privileges gain higher privileges over a network without user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01147 66th percentileScored 2026-11-07

Fix Fixed Skype for Business Server 2015 CU13 (Microsoft): 6.0.9319.886Skype for Business Server 2019 CU8 (Microsoft): 7.0.2046.583+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Skype for Business Server 2015 CU13	9319.0 to before 6.0.9319.886	6.0.9319.886	Patch available	CNA
Microsoft	Skype for Business Server 2019 CU8	2046.0 to before 7.0.2046.583	7.0.2046.583	Patch available	CNA
Microsoft	Skype for Business Server Subscription Edition CU1	2046.0 to before 7.0.2046.889	7.0.2046.889	Patch available	CNA

Skype for Business Server 2015 CU13 VendorMicrosoft Affected 9319.0 to before 6.0.9319.886 Fixed in 6.0.9319.886 Patch available CNA
Skype for Business Server 2019 CU8 VendorMicrosoft Affected 2046.0 to before 7.0.2046.583 Fixed in 7.0.2046.583 Patch available CNA
Skype for Business Server Subscription Edition CU1 VendorMicrosoft Affected 2046.0 to before 7.0.2046.889 Fixed in 7.0.2046.889 Patch available CNA

Remediation

Install 6.0.9319.886 for Skype for Business Server 2015 CU13, 7.0.2046.583 for Skype for Business Server 2019 CU8, and 7.0.2046.889 for Skype for Business Server Subscription Edition CU1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Skype for Business Server 2015 CU13 (Microsoft) Fixed in 6.0.9319.886
Fix · CNA Skype for Business Server 2019 CU8 (Microsoft) Fixed in 7.0.2046.583
Fix · CNA Skype for Business Server Subscription Edition CU1 (Microsoft) Fixed in 7.0.2046.889

Timeline

2026-10-13 Threatist record created from CVE-2026-83746
2026-10-13 Alias added: GHSA-69h8-r8mw-xc99
2026-10-25 Priority changed: LOW → MEDIUM

References

Patch 1

Skype for Business Elevation of Privilege Vulnerability

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences