Microsoft has patched a remote code execution flaw in Skype for Business Server that lets an ordinary logged-in user write files anywhere on a Persistent Chat server and run code on it, with no click needed from anyone else.
Tracked as CVE-2026-70297 and scored 8.8 on the CVSS scale, the bug was fixed in security updates released on 13 October 2026 for Skype for Business Server 2015 CU13, 2019 CU8 and Subscription Edition CU1. It was reported by Armadin researcher @mhskai2017.
According to Microsoft’s advisory, an authenticated attacker with a valid file token can send a crafted request containing a path-traversal sequence to an affected Persistent Chat server and execute code on it.
Path traversal means embedding directory instructions in a file name so the server saves a file somewhere it wasn’t meant to. Microsoft classifies this as CWE-36, absolute path traversal, in which the attacker supplies a full destination path rather than climbing out of a folder using “../” sequences.
The token is the only real barrier. Per the researcher’s account, it provides access to any chat room that supports file uploads, which in most deployments means any employee account or any account an attacker has phished. The CVSS vector reflects that: network-reachable, low attack complexity, low privileges and no user interaction, with full impact on confidentiality, integrity and availability.
A flaw in a feature that came back
Persistent Chat is an optional Skype for Business Server role that hosts topic-based chat rooms whose history is retained between sessions and is backed by its own SQL database. Microsoft left it out of Skype for Business Server 2019 at launch, then restored it as a separate installer in Cumulative Update 8, the same codebase that the Subscription Edition is built on. The component Microsoft brought back to ease customers into its final on-premises release is now carrying a code execution bug across all three supported versions.
The fixed builds are 6.0.9319.886 for Skype for Business Server 2015 CU13 (KB5132779), 7.0.2046.583 for 2019 CU8 (KB5131693) and 7.0.2046.889 for Subscription Edition CU1 (KB5131692).
Microsoft’s description ties the attack to servers running Persistent Chat. The advisory does not say whether deployments without that role are exposed, so administrators should install the update on every Skype for Business server rather than only the chat pool.
Last call for 2015 and 2019
The timing matters for older deployments. Both Skype for Business Server 2015 and 2019 left extended support in October 2025, and in its October 2026 update notice, Microsoft said patches for those two versions are available only to organisations in the paid Period 2 Extended Security Update (ESU) programme. After this month, security updates will ship only for the Subscription Edition. An organisation running 2015 or 2019 without ESU cannot obtain this fix and will receive no further ones.
CVE-2026-70297 is also the second file-path bug leading to code execution in the product in two months. In September, Microsoft fixed CVE-2026-66302, an external file path control flaw rated 9.8 that required no authentication, along with nine other Skype for Business vulnerabilities. The October fix arrived in the same Patch Tuesday release in October 2026.
Microsoft rates the flaw “Important” rather than ” Critical, and its scoring marks exploit code as unproven. As of 15 October 2026, no public proof-of-concept had surfaced, and the bug was not on the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue.
Armadin has not yet published technical details, and Microsoft has not said whether restricting file uploads in chat rooms reduces exposure before the update is applied.
Community Discussion
Join the conversation. Ask questions, share solutions, and help others.
Be the first to start the discussion!
