EUVD-2026-73940
GHSA-g37h-5rqx-hvqg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-accessible server crash requires only low-privilege SfB user credentials; no confidentiality or integrity impact, availability fully lost.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.
AnalysisAI
Null pointer dereference in Microsoft Skype for Business Server allows any authenticated low-privilege user to crash the server over the network, causing a complete denial of communications service. Three on-premises product lines are affected: Server 2015 CU13, Server 2019 CU8, and Subscription Edition CU1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Skype for Business user account (PR:L - low-privilege authenticated access), which in most enterprise deployments means any Active Directory domain user provisioned for SfB. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 6.5 (Medium) correctly reflects a network-accessible, low-complexity DoS requiring only PR:L (any authenticated SfB user). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Microsoft's released patches immediately: update Skype for Business Server 2015 to CU13 build 6.0.9319.885 or later, Server 2019 to CU8 build 7.0.2046.569 or later, and Subscription Edition to CU1 build 7.0.2046.879 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today