Absolute Path Traversal in Skype for Business Server and Skype for Business Server Subscription Edition - CVE-2026-70297
Published: October 14, 2026
Vulnerability identifier: #VU154952
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70297
CWE-ID: CWE-36
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on the server.
The vulnerability exists due to absolute path traversal in the Skype for Business Persistent Chat server when handling requests containing path traversal sequences. A remote user can send a specially crafted request to execute arbitrary code on the server.
Exploitation requires a valid file token. User interaction is not required.
Affected software
Skype for Business Server
Skype for Business Server Subscription Edition
Skype for Business Server Subscription Edition
How to mitigate CVE-2026-70297
Install security update from vendor's website.
Skype for Business Server - addressed in versions 6.0.9319.886, 7.0.2046.583
Skype for Business Server Subscription Edition - update to 7.0.2046.889
Skype for Business Server Subscription Edition - update to 7.0.2046.889