CVE-2026-66305: Skype for Business Spoofing Vulnerability

Overview

Severity

High (CVSS 7.1)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C

Category

Spoofing

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Sep

Released

2026-09-08

Description

Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.

FAQ

According to the CVSS metric, successful exploitation of this vulnerability could lead to a total loss of integrity (I:H). What does that mean for this vulnerability? An attacker who successfully exploited this vulnerability could inject content that appears to come from a trusted source, causing the affected application to display spoofed or manipulated content to the user.

Affected Products (3)

Microsoft Office

• Skype for Business Server 2015 CU13
• Skype for Business Server 2019 CU8
• Skype for Business Server Subscription Edition CU1

Security Updates (1)

• 5123287

Acknowledgments

Manish Kumar

Revision History

• 2026-09-08: Information published.