Skype for Business CVE-2026-63523

Exploitation requires that a victim user click or visit a crafted URL pointing to the vulnerable Skype for Business Server web component, as confirmed by the UI:R metric in the CVSS vector. The attacker requires no authentication to the server (PR:N) but must successfully deliver the malicious link through social engineering. The vulnerability is scoped to the three on-premises server product lines listed; Skype for Business Online (retired) and Microsoft Teams are not in scope. Deployments that have restricted Skype for Business web endpoints to internal-only network access significantly reduce external exploitation surface, as an external attacker would need to be on the internal network or route traffic through an internal user. Whether the XSS vector is reflected (requiring link delivery per victim) or stored (persistent, no per-victim social engineering required) is not confirmed from available data.

The CVSS 6.5 (Medium) vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N is internally consistent: exploitation is network-accessible with low complexity and requires no privileges (PR:N), but a victim must interact with attacker-controlled content (UI:R), meaningfully reducing practical exploitability relative to fully autonomous attacks. The C:H/I:N/A:N impact profile reflects Microsoft's standard XSS-as-spoofing classification, where the primary risk is session credential theft rather than data manipulation or service disruption. No EPSS score was supplied in the input; no KEV listing and no known public POC further reduce immediate urgency. Skype for Business Server is an on-premises enterprise product in active Microsoft end-of-life transition toward Teams, meaning the remaining exposure universe is contracting but may include organizations that have deferred migration. The description does not clarify whether the XSS is reflected or stored - stored XSS would substantially increase risk by eliminating the social-engineering delivery requirement, but this is not confirmed from available data.

An attacker crafts a malicious Skype for Business meeting join URL embedding an XSS payload and distributes it to target users via phishing email or instant message. When a recipient clicks the link and the vulnerable web component renders the page, the injected JavaScript executes in the victim's browser, exfiltrating the session cookie or authentication token to an attacker-controlled endpoint. The attacker then uses the stolen session material to impersonate the victim within the Skype for Business environment. No public exploit code exists at time of analysis, but the attack requires only social engineering to deliver the link.