CVE-2026-69642: Skype for Business Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
Other sources
Skype for Business Spoofing Vulnerability
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Review Microsoft Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU8, and Skype for Business Server Subscription Edition CU1. The provided data identifies these specific releases as affected.
Does exploitation require an authenticated account or user interaction?
No. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What impact is indicated if the issue is exploited?
The CVSS vector indicates low confidentiality and integrity impact, with no availability impact. The vulnerability is categorized as cross-site scripting and is described as enabling spoofing.