Skype for Business CVE-2026-66303

Exploitation requires a valid Skype for Business user account (PR:L - low-privilege authenticated access), which in most enterprise deployments means any Active Directory domain user provisioned for SfB. The attacker must have network access to the SfB Server (AV:N), though in typical deployments this server is not internet-facing. No non-default configuration or elevated privileges are required beyond basic SfB credentials. Limiting factors: authentication requirement (PR:L) narrows the attacker population to insiders or credential-compromised accounts; SSVC rates the attack as non-automatable, precluding mass-scanning campaigns; and impact is strictly availability - no confidentiality or integrity exposure exists.

CVSS 6.5 (Medium) correctly reflects a network-accessible, low-complexity DoS requiring only PR:L (any authenticated SfB user). SSVC reinforces moderate urgency: exploitation status is none, the attack is not automatable, and technical impact is rated partial - aligning with impact limited strictly to availability (C:N/I:N). The real-world risk is meaningful in enterprise environments where Skype for Business remains central to communications, as any insider or account with compromised SfB credentials can disrupt service for all users. However, the absence of a KEV listing, no POC, no confidentiality or integrity impact, and SSVC's non-automatable rating all argue against treating this as an emergency. Organizations with broad SfB user populations face higher exposure than those with tightly controlled accounts.

An authenticated Skype for Business user - any domain user with a valid SfB account, including a disgruntled employee or an attacker who has compromised SfB credentials - sends a specially crafted network request to the SfB Server. The server dereferences a null pointer when processing the request, crashing the server process and interrupting voice, video, and messaging services for all active users until the process is restarted. No public exploit code has been identified at time of analysis.