EUVD-2026-74043
GHSA-wwcv-p4qq-wm65
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible, no-auth SSRF with confidentiality-only impact; no integrity or availability effect; scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Server-side request forgery in Microsoft Skype for Business Server exposes internal network resources to unauthenticated remote attackers. Three server product lines are affected - Subscription Edition, 2015 (CU13), and 2019 (CU8) - all running builds below their respective patched versions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network reachability to the Skype for Business Server on a vulnerable build - the CVSS vector AV:N/AC:L/PR:N/UI:N indicates default network-exposed configurations are affected without authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 score is well-supported by the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N): fully network-accessible, low complexity, no credentials required, and high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: apply the cumulative updates that bring Skype for Business Server Subscription Edition to 7.0.2046.879 or later, Skype for Business Server 2015 to 6.0.9319.885 or later, and Skype for Business Server 2019 to 7.0.2046.569 or later, per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66304. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Skype for Business Server instances running the affected versions and apply Microsoft's released security update. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today