EUVD-2026-74044
GHSA-j9qr-gj45-j8p8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, unauthenticated, no user interaction path/filename control yielding server code execution supports AV:N/AC:L/PR:N/UI:N and full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
5DescriptionCVE.org
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Skype for Business Server (2015 CU13, 2019 CU8, and Subscription Edition CU1) lets an unauthenticated network attacker run arbitrary code by controlling a file name or path processed by the server (CWE-73). The flaw was reported by Microsoft's own MSRC team and a patch is available; there is no public exploit identified at time of analysis and no CISA KEV listing, but the pre-authentication, network-reachable RCE profile makes it a top-priority patch for any on-premises deployment.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions per the CVSS vector - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against affected on-premises Skype for Business Server front-end/edge roles is stated to require no authentication or user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes remote, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact, and the reporter is Microsoft's own security team, lending credibility to the impact rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: apply the Microsoft security update that raises each affected build to or above the fixed versions - 6.0.9319.885 for Skype for Business Server 2015 CU13, 7.0.2046.569 for 2019 CU8, and 7.0.2046.879 for Subscription Edition CU1 - as documented in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66302). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Microsoft Skype for Business Server deployments and document which versions (2015 CU13, 2019 CU8, or Subscription Edition CU1) are currently running; document network accessibility to determine which systems face the highest risk. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today