CVE-2026-70297: Skype for Business Remote Code Execution Vulnerability

Overview

Severity

High (CVSS 8.8)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Category

Remote Code Execution

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Oct

Released

2026-10-13

Description

Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.

FAQ

How could an attacker exploit this vulnerability? An authenticated attacker who holds a valid file token could send a specially crafted request containing a path traversal sequence to an affected Skype for Business Persistent Chat server. Successful exploitation could allow the attacker to execute code on the server. User interaction is not required.

Affected Products (3)

Microsoft Office

• Skype for Business Server Subscription Edition CU1
• Skype for Business Server 2015 CU13
• Skype for Business Server 2019 CU8

Security Updates (1)

• 5131692

Acknowledgments

<a href="https://www.linkedin.com/in/đức-nguyễn-văn-minh-19a925287/">Nguyen Van Minh Duc</a> with <a href="https://saigonnewport.com.vn/">Saigon Newport Corporation</a>, <a href="https://www.linkedin.com/in/nagendratiwari01/">Nagendra Tiwari</a>, Ethan Walker, <a href="https://x.com/mhskai2017">Kai Huang</a> with <a href="https://armadin.com/">Armadin</a>, Anonymous

Revision History

• 2026-10-13: Information published.