Skype for Business CVE-2026-70297

Exploitation requires the attacker to already hold low-privileged authenticated access to the Skype for Business Server / Microsoft Lync service (CVSS PR:L), after which a crafted network request supplying an absolute file path (CWE-36) is processed with no user interaction (UI:N) and low complexity (AC:L). Affected deployments are Skype for Business Server Subscription Edition (<7.0.2046.889), Skype for Business Server 2015 CU13 (<6.0.9319.886), and Skype for Business Server 2019 CU8 (<7.0.2046.583); patched builds remove exposure. The primary limiting factor is the authentication requirement - this is not remote-unauthenticated - meaning realistic risk concentrates on insiders or attackers who have already compromised a valid account or foothold.

This is a credible, actionable priority rather than an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low-level authentication (PR:L) and no user interaction, yielding total compromise of confidentiality, integrity, and availability - consistent with CWE-36 absolute path traversal leading to remote code execution. CISA's SSVC framework corroborates the severity on impact (Technical Impact: total) while tempering urgency on exploitability: Exploitation is assessed as 'none' (no observed activity) and Automatable is 'no', indicating the attack cannot be trivially mass-scaled. No EPSS score and no KEV listing were supplied, and no POC is indicated, so exploitation status is 'no public exploit identified at time of analysis.' The signals are therefore consistent, not conflicting: high technical impact with, as yet, no evidence of in-the-wild use. The key limiter is PR:L - an attacker must already hold valid low-privileged credentials/access to the Skype for Business/Lync service, which narrows the realistic threat to authenticated insiders or attackers who have already obtained a foothold or valid account.

An attacker holding low-privileged authenticated access to a Skype for Business Server sends a crafted network request containing an absolute file path that the server resolves outside its intended directory, writing or executing attacker-controlled content to achieve code execution. No user interaction is required and attack complexity is low, but valid low-level credentials are needed first. No public proof-of-concept is indicated at the time of analysis.