Skype for Business Server: Absolute path traversal allows privilege escalation
Summary
Absolute path traversal in Skype for Business Server and Microsoft Lync allows an authorized attacker with network access to elevate privileges. The CVSS 3.1 base score is 8.1 (High), with high impact on integrity and availability. NVD status was still Awaiting Analysis at the time of research, and the vendor's own advisory page could not be verified.
Affected
- Skype for Business Server 2015 CU13: builds 9319.0 to before 6.0.9319.886
- Skype for Business Server 2019 CU8: builds 2046.0 to before 7.0.2046.583
- Skype for Business Server Subscription Edition CU1: builds 2046.0 to before 7.0.2046.889
Fixed in
- Subscription Edition CU1 Security Update 2: KB5131692 (build 7.0.2046.889)
- 2019 CU8 Security Update 4: KB5131693 (build 7.0.2046.583)
- 2015 CU13 Security Update 4: KB5132779 (build 6.0.9319.886)
- Unknown whether Subscription Edition RTM receives a fix.
Workaround
No vendor workaround found. Patching is the only documented remedy.
Exploitation
- Not listed in CISA KEV as of research.
- CISA SSVC data in the CVE record: exploitation none, automatable no, technical impact total.
- No public proof of concept found.
Our recommendation
- Confirm the server version and build, and apply the matching KB update.
- Limit access to the internal network and review which accounts have valid credentials.
- Plan migration off Skype for Business Server 2015 and 2019: both are out of support, and the last month for Period 2 ESU eligibility is October 2026. Servers without ESU enrolment will not receive this fix or future fixes.
- Monitor for unusual privilege changes on Skype for Business servers.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83746 msrc.microsoft.com
- Microsoft KB5131692: Skype for Business Subscription Edition support.microsoft.com
- Microsoft Tech Community: October 2026 Skype for Business Server security updates techcommunity.microsoft.com
- Vulners NVD record CVE-2026-83746 vulners.com
- OpenCVE: CVE-2026-83746 app.opencve.io
- Tenable plugin 366092 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:26.
Original description (NVD)
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.