CVE-2026-70297

Microsoft · Published October 13, 2026

8.8

CVSS v3.1

HIGH

Patch availableGet patch

Description

Skype for Business Remote Code Execution Vulnerability. Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.

Affected Products

Skype for Business Server Subscription Edition CU1
Skype for Business Server 2015 CU13
Skype for Business Server 2019 CU8

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C