SB2026101412 - Multiple vulnerabilities in Skype for Business Server
Published: October 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Absolute Path Traversal (CVE-ID: CVE-2026-70297)
CWE-ID: CWE-36 - Absolute Path Traversal
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the server.
The vulnerability exists due to absolute path traversal in the Skype for Business Persistent Chat server when handling requests containing path traversal sequences. A remote user can send a specially crafted request to execute arbitrary code on the server.
Exploitation requires a valid file token. User interaction is not required.
2) Absolute Path Traversal (CVE-ID: CVE-2026-83746)
CWE-ID: CWE-36 - Absolute Path Traversal
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges and delete targeted files on a system.
The vulnerability exists due to absolute path traversal in Skype for Business and Microsoft Lync when handling file paths over a network. A remote user can exploit the path traversal to escalate privileges and delete targeted files on a system.
3) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-85873)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to read arbitrary files on the system.
The vulnerability exists due to improper authorization in Skype for Business and Microsoft Lync when handling download requests. A remote user can manipulate a download request sent to an affected server to read arbitrary files on the system.
Remediation
Install update from vendor's website.