CVE-2026-83746
8.1HighPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity, availability
- Weakness
- CWE-36
Impact
An authenticated network attacker can elevate privileges to compromise data integrity and disrupt service. They need valid credentials to access the Skype for Business or Microsoft Lync environment.
Root cause
An absolute path traversal flaw fails to properly sanitize file paths supplied by authorized users.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Fix & remediation
Install the security update from Microsoft for your specific Skype for Business or Lync deployment via the MSRC guide. If patching must wait, restrict network access to the server to trusted administrative segments only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.