CVE-2026-66304: Skype for Business Information Disclosure Vulnerability
Published Sep 8, 2026
·Updated
Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.
Other sources
Skype for Business Information Disclosure Vulnerability
— Microsoft
Affected Software
9 affected componentsFixes available
Microsoft Skype for Business Server 2019 CU8<7.0.2046.569
7.0.2046.569
Microsoft Skype for Business Server 2015 CU13<6.0.9319.885
6.0.9319.885
Microsoft Skype for Business Server Subscription Edition CU1<7.0.2046.879
7.0.2046.879
Microsoft Skype for Business Server=2015-cumulative_update_13
Microsoft Skype for Business Server=2015-cumulative_update_13_hotfix_2
Microsoft Skype for Business Server=2019-cumulative_update_8
Microsoft Skype for Business Server=2019-cumulative_update_8_hotfix1
Microsoft Skype for Business Server=2019-cumulative_update_8_hotfix2
Microsoft Skype For Business Server Subscription Edition=7.0.2046.849
Remediation
Event History
Sep 8, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·06:30 PM
Data Sourced
via MITRE·06:30 PM
DescriptionSeverity
Data Sourced
via NVD·07:18 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Which Skype for Business Server releases are identified as affected?
Microsoft Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU8, and Skype for Business Server Subscription Edition CU1 are listed.
2
Does exploitation require an authenticated account or user interaction?
No. The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
3
What is the stated security impact?
The issue can allow an unauthorized attacker to disclose information over a network. The supplied metrics indicate high confidentiality impact, with no indicated integrity or availability impact.