Skype for Business Server CVE-2026-66304

No special conditions are required beyond network reachability to the Skype for Business Server on a vulnerable build - the CVSS vector AV:N/AC:L/PR:N/UI:N indicates default network-exposed configurations are affected without authentication. Exploitation is limited by: (1) the attacker must reach the server over the network - internet-facing deployments are at highest risk; organizations that place Skype for Business Server behind a VPN or restrict it to internal networks reduce exposure significantly; (2) impact is limited to information disclosure (C:H/I:N/A:N) - there is no direct code execution or integrity impact from this vulnerability alone; (3) all three affected product lines must be running a pre-patch cumulative update build - fully patched installations are not vulnerable.

The CVSS 7.5 score is well-supported by the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N): fully network-accessible, low complexity, no credentials required, and high confidentiality impact. The SSVC assessment reinforces urgency - 'Automatable: yes' means this can be scripted at scale, making mass-scanning campaigns realistic even in the absence of a currently known public exploit. Technical Impact is rated 'partial', consistent with the information-disclosure-only nature (I:N/A:N). No active exploitation is confirmed (SSVC exploitation status: none; no CISA KEV listing), and no POC is publicly available, which moderates the immediate operational risk. EPSS data is not provided in the source intelligence, so probability of near-term exploitation cannot be quantified from that signal. The primary real-world concern is internal network enumeration - attackers who can reach the Skype for Business Server over the internet could pivot to probe RFC-1918 address space, internal APIs, or credential-bearing services such as metadata endpoints in cloud-hosted deployments. The 'no special conditions' nature of the exploit (PR:N, AC:L) means any organization with an internet-exposed Skype for Business Server running a pre-patch build is exposed.

An unauthenticated attacker with network access to the Skype for Business Server sends a crafted HTTP request containing a URL pointing to an internal host - such as an internal admin panel, a cloud metadata endpoint, or an internal REST API - to a vulnerable API or signaling endpoint. The server fetches that URL and returns enough of the response to the attacker to reveal internal service banners, credentials, or configuration data. Because exploitation requires no authentication and low complexity, this scenario is amenable to automated scanning; no public POC is currently known but the SSVC 'Automatable: yes' assessment indicates the technique is readily scriptable.