CVE-2026-69646: Skype for Business Spoofing Vulnerability
Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.
Other sources
Skype for Business Spoofing Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.879Patch KB5123287 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.9319.885Patch KB5123301 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.569Patch KB5123300
Event History
Frequently Asked Questions
Which deployments are affected?
The affected products listed are Microsoft Skype for Business Server 2015 CU13, Skype for Business Server Subscription Edition CU1, and Skype for Business Server 2019 CU8.
What access does an attacker need to exploit this issue?
An attacker can exploit the vulnerability without privileges or user interaction, but must be on an adjacent network. The issue involves improper verification of a cryptographic signature and enables spoofing.