Skype for Business EUVD-2026-100141

Exploitation requires a valid authenticated account on the target (CVSS PR:L - the description's 'authorized attacker'), so this is not reachable by anonymous/unauthenticated remote callers despite the network vector (AV:N). No user interaction is needed (UI:N) and attack complexity is low (AC:L). The affected deployments are specifically Skype for Business Server 2019 (CU8, builds below 7.0.2046.583), Skype for Business Server Subscription Edition (CU1, below 7.0.2046.889), and Skype for Business Server 2015 (CU13, below 6.0.9319.886); environments patched to or above those builds are not affected. The limiting factor that most reduces real-world risk is the authentication requirement combined with CISA SSVC rating exploitation 'none' and Automatable 'no'.

Multiple signals point to a genuine but not top-tier emergency. The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N) reflects network reach, low attack complexity, no user interaction, but required privileges (PR:L) - meaning the attacker must already be an authenticated, low-privileged user. Impact is high to integrity and availability (I:H/A:H) with no confidentiality loss (C:N), consistent with a path-traversal write/overwrite primitive leading to privilege elevation rather than data theft. CISA's SSVC framework tempers the urgency: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (exploitation cannot be reliably scripted at scale, consistent with the PR:L authentication precondition), while Technical Impact is 'total'. There is no CISA KEV listing and no EPSS score provided in the input, and no public proof-of-concept is referenced - so exploitation probability cannot be quantified from the data given. Net assessment: this is a real, patch-worthy elevation-of-privilege flaw in enterprise collaboration infrastructure, but the authentication requirement and 'not automatable / no known exploitation' SSVC signals indicate it is a priority patch rather than an emergency drop-everything remote-unauthenticated issue. Note a minor tension to verify: the description calls the attacker 'authorized' (aligning with PR:L), yet the term 'elevate privileges over a network' combined with CWE-36 absolute path traversal suggests the real risk is an authenticated low-priv user overwriting privileged files - confirm the exact privilege boundary with the Microsoft MSRC advisory.

An authenticated low-privileged user on the network submits a request to the Skype for Business / Lync server containing a crafted absolute file path, causing the server to read or write files outside the intended directory. By overwriting a privileged configuration or executable file, the attacker escalates to higher privileges on the server. No public exploit code is identified at time of analysis, and the attack requires valid credentials (PR:L), limiting it to insiders or attackers who have already obtained a foothold.