CVE-2026-83746: Skype for Business Elevation of Privilege Vulnerability
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
Other sources
Skype for Business Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.889Patch KB5131692 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.583Patch KB5131693 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.9319.886Patch KB5132779
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized and able to reach the affected Skype for Business or Microsoft Lync deployment over the network. The issue does not require user interaction and has low attack complexity.
What is the likely security impact?
Successful exploitation can elevate the attacker's privileges. The supplied severity vector indicates integrity and availability impacts, while no confidentiality impact is listed.
Are the listed server releases affected?
The affected software list includes Skype for Business Server 2019 CU8, Skype for Business Server Subscription Edition CU1, and Skype for Business Server 2015 CU13, along with Microsoft Skype for Business. The provided data does not state whether later cumulative updates or other releases are affected.