CVE-2026-66302: CWE-73: External Control of File Name or Path in Microsoft Skype for Business Server 2015 CU13

This vulnerability, tracked as CVE-2026-66302, affects Microsoft Skype for Business Server 2015 CU13. It is classified under CWE-73 (External Control of File Name or Path), which means an attacker can manipulate file paths or names externally, leading to remote code execution. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting that the attack can be performed remotely with no privileges or user interaction, and results in complete compromise of confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An attacker can remotely execute arbitrary code on affected Skype for Business Server 2015 CU13 systems without authentication or user interaction. This can lead to full system compromise, including unauthorized access to sensitive data, modification or destruction of information, and disruption of service.

Microsoft has released an official fix for this vulnerability. It is recommended to apply the provided security update from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66302 to remediate this issue. No additional mitigation steps are indicated by the vendor.