Skype for Business Server CVE-2026-66305

Exploitation requires the attacker to hold a valid, low-privileged Skype for Business account (PR:L) on the target server - unauthenticated exploitation is not possible per the CVSS vector. The target must be running an unpatched version of one of the three Skype for Business Server branches (2015 CU13 < 6.0.9319.885, 2019 CU8 < 7.0.2046.569, or Subscription Edition CU1 < 7.0.2046.879). Network access to the Skype for Business Server front-end services is required. No special non-default configuration is documented as required - the flaw exists in the default authentication handling of these server versions. Exploitation is limited to actors who have already obtained valid platform credentials.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, score 7.1) indicates a network-reachable, low-complexity exploit requiring only a low-privileged (authenticated) account, with high integrity impact. The PR:L requirement is the primary limiting factor - an attacker must already hold a valid Skype for Business account or network session credential. The I:H rating reflects the ability to spoof identities, which in an enterprise communications context carries significant social-engineering amplification risk (e.g., impersonating executives or IT staff in IM/voice sessions). C:L likely reflects incidental disclosure of session metadata during spoofing. No KEV listing and no public POC exist at time of analysis, and EPSS data is not provided, so exploitation probability is assessed as low-to-moderate. This is a meaningful enterprise risk in organizations still running on-premises Skype for Business rather than Microsoft Teams, but the authentication prerequisite meaningfully constrains the attacker population to insiders or compromised accounts.

An attacker holding a valid but low-privileged Skype for Business account connects to the server and crafts a session request that substitutes another user's identity in client-controlled authentication fields. Because the server does not re-validate identity server-side, it accepts the spoofed session, and the attacker can send messages, initiate calls, or interact with other users appearing to be the impersonated account. No public proof-of-concept exists, but the low complexity rating suggests the technique does not require advanced tooling.