Microsoft Skype for Business Server: Path traversal allows remote code execution
Summary
An absolute path traversal flaw in on-premises Skype for Business Server, also covered under the Lync name, allows an authorized attacker to execute code over the network. The attacker needs low privileges and a valid file token, and the flaw is rated High with CVSS 8.8. Exposure of the Persistent Chat and front-end services to the internet increases the risk.
Affected
- Microsoft Skype for Business Server 2015 CU13: affected 9319.0 to < 6.0.9319.886
- Microsoft Skype for Business Server 2019 CU8: affected 2046.0 to < 7.0.2046.583
- Microsoft Skype for Business Server Subscription Edition CU1: affected 2046.0 to < 7.0.2046.889
- Lync: Unknown.
Fixed in
- Skype for Business Server 2015 CU13: KB5132779 (build 6.0.9319.886, not yet verified against the Microsoft KB page)
- Skype for Business Server 2019 CU8: KB5131693 (build 7.0.2046.583, not yet verified against the Microsoft KB page)
- Skype for Business Server Subscription Edition CU1: KB5131692 (build 7.0.2046.889, not yet verified against the Microsoft KB page)
- KB numbers and builds are taken from secondary sources. Please check them on the Microsoft Update Guide before relying on them.
Workaround
No workaround documented in the sources reviewed. Restricting external access to the Persistent Chat and front-end services reduces exposure, but this is a general measure and not a vendor workaround.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC data: exploitation none, automatable no.
- No public proof of concept found. This does not prove that none exists.
- Microsoft Exploitability rating: E:U (Unproven).
Our recommendation
- Install the security updates for all affected Skype for Business Server installations as soon as possible.
- Check whether Persistent Chat or front-end services are reachable from the internet and restrict access where possible.
- Review logs for path traversal requests.
- Confirm the lifecycle status of your Skype for Business Server version with Microsoft. If the platform is out of support, plan a migration, for example to Teams.
- Ask Microsoft about the status of Lync.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-70297 msrc.microsoft.com
- Vulners: NVD CVE-2026-70297 (KB numbers, secondary) vulners.com
- OpenCVE: CVE-2026-70297 app.opencve.io
- Tenable plugin 366092 (build numbers, secondary) www.tenable.com
- Strix: CVE-2026-70297 (secondary) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:44.
Original description (NVD)
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.