CVE-2026-70297: Skype for Business Remote Code Execution Vulnerability
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
Other sources
Skype for Business Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.583Patch KB5131693 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.889Patch KB5131692 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.9319.886Patch KB5132779
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Review Microsoft Skype for Business Server 2019 CU8, Skype for Business Server Subscription Edition CU1, and Skype for Business Server 2015 CU13. The affected products are server deployments, so prioritize instances reachable over the network by authorized users.
What level of access does an attacker need?
An attacker must be authorized and able to interact with the affected server over a network. No user interaction is required, and the attack complexity is listed as low.
How can we determine whether we are affected?
Inventory Skype for Business and Microsoft Lync server deployments and compare them against the listed affected software: Skype for Business Server 2019 CU8, Subscription Edition CU1, and Skype for Business Server 2015 CU13.