CVE-2026-70297
8.8HighPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-36
Impact
Authenticated network attackers can remotely execute code on the host. They only need low-privilege access and network connectivity to the service.
Root cause
Improper limitation of a pathname to a restricted directory (absolute path traversal) allows file access outside intended boundaries.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Install the official security update from Microsoft for affected Skype for Business or Lync installations once available. If you cannot patch immediately, restrict network access to the Skype for Business/Lync service to trusted IP ranges.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.