Absolute Path Traversal Vulnerability in Skype for Business by Microsoft
CVE-2026-83746

8.1HIGH

Key Information:

Vendor

Microsoft
Status
Skype For Business Server 2015 Cu13
Skype For Business Server 2019 Cu8
Skype For Business Server Subscription Edition Cu1
Vendor
CVE Published:
13 October 2026

What is CVE-2026-83746?

An absolute path traversal vulnerability in Skype for Business and Microsoft Lync exposes a risk where an authorized attacker can exploit the system to elevate their privileges across the network, potentially gaining unauthorized access to sensitive resources and functionalities.

Affected Version(s)

Skype for Business Server 2015 CU13 x64-based Systems 9319.0 < 6.0.9319.886

Skype for Business Server 2019 CU8 x64-based Systems 2046.0 < 7.0.2046.583

Skype for Business Server Subscription Edition CU1 x64-based Systems 2046.0 < 7.0.2046.889

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.