CVE-2026-66304

Microsoft · Published September 8, 2026

7.5

CVSS v3.1

HIGH

Patch availableGet patch

Description

Skype for Business Information Disclosure Vulnerability. Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.

Affected Products

Skype for Business Server 2019 CU8
Skype for Business Server Subscription Edition CU1
Skype for Business Server 2015 CU13

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C