Skype for Business Elevation of Privilege Vulnerability

Microsoft · EN CVE-2026-83746 Important Action required CVSS 8.1

Published 13 okt 2026

Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.1 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do? Install the security update for the version you run (or a later cumulative update):
- Skype for Business Server 2015 CU13: KB5132779 6.0.9319.886
- Skype for Business Server 2019 CU8: KB5131693 7.0.2046.583
- Skype for Business Server Subscription Edition CU1: KB5131692 7.0.2046.889

Skype for Business and Microsoft Lync · Elevation of Privilege

Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.

Key facts

Released

13 okt 2026

Impact

Elevation of Privilege

Max severity

Important

Weakness

CVSS 3.1

8.1 / 7.1 (base / temporal)

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C

Publicly disclosed

Exploited

Exploitability assessment

Exploitation Less Likely

Customer action required

Yes

Links

Product	Update	Build
Skype for Business Server 2015 CU13	KB5132779	`6.0.9319.886`
Skype for Business Server 2019 CU8	KB5131693	`7.0.2046.583`
Skype for Business Server Subscription Edition CU1	KB5131692 · Security Update	`7.0.2046.889`

What privileges could be gained by an attacker who successfully exploited the vulnerability?: An attacker would be able to delete targeted files on a system.

Version	Date	Note
1	13 okt 2026	Information published.

This is in the weekly digest for week 42: everything that changed in Microsoft 365 this week. →

Source: Microsoft Security Update Guide. 365Fanatic is not affiliated with Microsoft.