The vulnerability is an absolute path traversal flaw in Skype for Business and Microsoft Lync that permits an attacker with authorized network access to craft malicious path requests and execute arbitrary code on the server.

Microsoft Skype for Business Server 2015 CU13, Microsoft Skype for Business Server 2019 CU8, and Microsoft Skype for Business Server Subscription Edition CU1 are affected by this path traversal flaw.

The flaw carries a CVSS score of 8.8, indicating high severity. The EPSS score is 1%, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires an attacker who already has authorized access to the network or service; once accessed, the attacker can traverse the filesystem and execute code, leading to full system compromise. The overall risk remains high due to the severity of the impact and the potential for widespread damage within the affected environment.