CVE-2026-66303: Skype for Business and Lync Denial of Service Vulnerability
Published Sep 8, 2026
·Updated
Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.
Other sources
Skype for Business and Lync Denial of Service Vulnerability
— Microsoft
Affected Software
9 affected componentsFixes available
Microsoft Skype for Business Server Subscription Edition CU1<7.0.2046.879
7.0.2046.879
Microsoft Skype for Business Server 2015 CU13<6.0.9319.885
6.0.9319.885
Microsoft Skype for Business Server 2019 CU8<7.0.2046.569
7.0.2046.569
Microsoft Skype for Business Server=2015-cumulative_update_13
Microsoft Skype for Business Server=2015-cumulative_update_13_hotfix_2
Microsoft Skype for Business Server=2019-cumulative_update_8
Microsoft Skype for Business Server=2019-cumulative_update_8_hotfix1
Microsoft Skype for Business Server=2019-cumulative_update_8_hotfix2
Microsoft Skype For Business Server Subscription Edition=7.0.2046.849
Remediation
Event History
Sep 8, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·06:39 PM
Data Sourced
via MITRE·06:39 PM
DescriptionSeverity
Data Sourced
via NVD·07:18 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker must be authorized and able to reach the affected Skype for Business or Lync service over the network. The provided data does not indicate that unauthenticated attackers can exploit it.
2
What is the impact of successful exploitation?
Successful exploitation can cause a denial of service through a null pointer dereference. The supplied CVSS vector indicates no confidentiality or integrity impact.
3
Which deployments are identified as affected?
The affected software listed is Microsoft Skype for Business Server Subscription Edition CU1, Skype for Business Server 2015 CU13, and Skype for Business Server 2019 CU8.