Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An authenticated attacker who holds a valid file token could send a specially crafted request containing a path traversal sequence to an affected Skype for Business Persistent Chat server. Successful exploitation could allow the attacker to execute code on the server. User interaction is not required.
Security updates
7.0.2046.889 — https://support.microsoft.com/help/5131692
6.0.9319.886 — https://support.microsoft.com/help/5132779
7.0.2046.583 — https://support.microsoft.com/help/5131693
Vulnerabilities 1
-
High 8.8
Skype for Business Remote Code Execution Vulnerability
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-70297 Skype for Business Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70297
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss