Skype for Business EUVD-2026-74044

No special conditions per the CVSS vector - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against affected on-premises Skype for Business Server front-end/edge roles is stated to require no authentication or user interaction. The limiting factors are: the target must be a vulnerable on-premises Skype for Business Server (2015 CU13 below 6.0.9319.885, 2019 CU8 below 7.0.2046.569, or Subscription Edition CU1 below 7.0.2046.879) and must be network-reachable by the attacker; cloud-based Microsoft Teams is not the affected product. Exact triggering feature/endpoint is not detailed in the available data and should be confirmed against the MSRC advisory.

This is a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes remote, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact, and the reporter is Microsoft's own security team, lending credibility to the impact rating. Counterbalancing signals: no EPSS score, POC status, or SSVC decision data was provided, and there is no CISA KEV entry, so active exploitation is NOT confirmed and automatability is unknown - the urgency is driven by the vulnerability's intrinsic pre-auth RCE nature, not by observed attacks. Because Skype for Business front-end/edge servers are frequently internet-reachable to support external/federated access, the exposed attack surface is real, and any organization still running on-premises Skype for Business should treat this as urgent and patch immediately. The one input tag, 'Authentication Bypass,' does not match the CWE-73 root cause and should not be relied upon for triage.

An attacker with only network access to an internet-reachable or internally-reachable Skype for Business front-end/edge server sends a crafted request whose parameters control a file name or path processed by the server, steering a file operation to execute attacker-chosen content and yielding code execution in the server's context. No authentication or user interaction is required per the CVSS vector; no public POC has been identified at time of analysis, so this scenario is inferred from the CVSS metrics and CWE-73 root cause.