CVE-2026-70297: Skype for Business Path Traversal RCE

CVE-2026-70297 Overview

CVE-2026-70297 is an absolute path traversal vulnerability affecting Microsoft Skype for Business and Microsoft Lync. An authenticated attacker can exploit the flaw to execute arbitrary code over a network. The weakness is classified under CWE-36: Absolute Path Traversal and requires low privileges and no user interaction.

Critical Impact
Successful exploitation allows an authorized attacker to execute code remotely against affected Skype for Business and Microsoft Lync deployments, compromising confidentiality, integrity, and availability.

Affected Products

Microsoft Skype for Business
Microsoft Lync
Refer to the Microsoft Vulnerability Advisory CVE-2026-70297 for specific version coverage

Discovery Timeline

2026-10-13 - CVE-2026-70297 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-70297

Vulnerability Analysis

The vulnerability stems from improper handling of absolute file paths within Skype for Business and Microsoft Lync server components. An attacker supplies a crafted absolute path that bypasses the application's intended directory boundaries. The server then reads or writes files outside the expected location, which enables code execution in the context of the affected service.

Exploitation requires network access and valid, low-privilege credentials. No user interaction is required to complete the attack chain. The impact to confidentiality, integrity, and availability is each rated high, consistent with remote code execution against a messaging and collaboration service.

Root Cause

The root cause is insufficient validation of user-supplied path input, categorized as CWE-36: Absolute Path Traversal. The affected components accept absolute paths that resolve to attacker-controlled locations rather than restricting input to a validated subdirectory. This design gap permits placement or retrieval of files in sensitive paths that the service process can execute.

Attack Vector

The attack originates over the network against exposed Skype for Business or Lync endpoints. An authenticated attacker submits a request containing an absolute path pointing to attacker-controlled content. The server consumes the path without canonicalization, loads or writes the referenced artifact, and executes code in the service account context.

No verified public proof-of-concept code is available at the time of publication. See the Microsoft Vulnerability Advisory CVE-2026-70297 for additional technical context.

Detection Methods for CVE-2026-70297

Indicators of Compromise

Requests to Skype for Business or Lync endpoints containing absolute file paths such as C:\, \\?\, or UNC paths in parameters that normally accept relative identifiers
Unexpected file writes under service installation directories, web application roots, or inetpub paths
New or modified executable, DLL, or script files owned by the Skype for Business or Lync service account
Child processes spawned by the Skype for Business or Lync service that are inconsistent with normal operation

Detection Strategies

Inspect HTTP and SIP request logs for path parameters containing drive letters, UNC prefixes, or encoded path separators
Correlate authenticated session activity with subsequent file system writes to server application directories
Baseline process execution for the Skype for Business and Lync service accounts and alert on deviations

Monitoring Recommendations

Enable detailed IIS, SIP, and application-layer logging on all front-end and edge servers
Forward Windows Security, Sysmon, and application logs to a centralized analytics platform for correlation
Monitor for authentication from unexpected source networks followed by file write or process creation events on Skype for Business or Lync hosts

How to Mitigate CVE-2026-70297

Immediate Actions Required

Apply the vendor security update referenced in the Microsoft Vulnerability Advisory CVE-2026-70297 as soon as change windows permit
Audit Skype for Business and Lync accounts, revoke unused credentials, and enforce multi-factor authentication for all users
Restrict network reachability of Skype for Business and Lync front-end and edge services to trusted sources where possible

Patch Information

Microsoft has published guidance and updates for this vulnerability. Administrators should consult the Microsoft Vulnerability Advisory CVE-2026-70297 to identify the correct update for each deployed product and version, then deploy it through standard patch management processes.

Workarounds

Limit exposure of Skype for Business and Lync services to internal networks or trusted VPN segments pending patch deployment
Enforce least-privilege access so that compromised accounts cannot reach administrative or server-side components
Apply web application firewall rules that block requests containing absolute paths, drive letters, or UNC prefixes in unexpected parameters

bash

# Example WAF rule concept blocking absolute path patterns in request parameters
# Pseudocode - adapt to your WAF syntax
SecRule ARGS "@rx (?i)(^|[=&])([a-z]:\\|\\\\\?\\|\\\\[a-z0-9_.-]+\\)" \
  "id:1070297,phase:2,deny,status:400,msg:'Absolute path traversal attempt (CVE-2026-70297)'"