CVE-2026-83746

HIGH

MEDIUM Priority: 0.09 BB Relevance: 66/100

Published: 2026-10-13 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Network Low Complexity No Interaction Integ. Impact

AV: Network

AC: Low

PR: Low

UI: None

S: Unchanged

C: None

I: High

A: High

Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.

Vendor	Product	Version
Microsoft	Skype for Business Server 2015 CU13	9319.0 < 6.0.9319.886
Microsoft	Skype for Business Server 2015 CU13	9319.0 < 6.0.9319.886
Microsoft	Skype for Business Server 2019 CU8	2046.0 < 7.0.2046.583
Microsoft	Skype for Business Server 2019 CU8	2046.0 < 7.0.2046.583
Microsoft	Skype for Business Server Subscription Edition CU1	2046.0 < 7.0.2046.889
Microsoft	Skype for Business Server Subscription Edition CU1	2046.0 < 7.0.2046.889

vendor-advisory patch

66 / 100

✓ Network accessible
✓ Low complexity
✓ No user interaction

8.1 / 10.0 v3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C

1.15%

Raw Score 0.011470

Percentile 66.7%

Date 2026-10-29

2026-10-29

0.01147

2026-10-28

0.01147

mitre ref →