CVE-2026-66305: Skype for Business Spoofing Vulnerability
Skype for Business Spoofing Vulnerability
Other sources
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.569Patch KB5123300 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.9319.885Patch KB5123301 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.879Patch KB5123287
Event History
Frequently Asked Questions
Which deployments are identified as affected?
The affected software listed is Microsoft Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU8, and Skype for Business Server Subscription Edition CU1.
What access does an attacker need to exploit this issue?
The attacker must be authorized and able to act over a network. The provided information does not indicate that user interaction is required.