EUVD-2026-73937
GHSA-9823-h4m8-w7cq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
PR:L confirmed by 'authorized attacker' framing; AV:N and AC:L reflect SIP network accessibility with no exploitation complexity; I:H for identity spoofing, C:L for incidental session data exposure.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Client-side authentication bypass in Microsoft Skype for Business Server enables a low-privileged network attacker to perform identity spoofing against other users on the platform. The flaw stems from CWE-603 (Use of Client-Side Authentication), where the server delegates trust to client-controlled data, allowing an authenticated user to forge session identity and corrupt integrity of communications. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid, low-privileged Skype for Business account (PR:L) on the target server - unauthenticated exploitation is not possible per the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, score 7.1) indicates a network-reachable, low-complexity exploit requiring only a low-privileged (authenticated) account, with high integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released cumulative updates: upgrade Skype for Business Server 2015 to version 6.0.9319.885 or later, Server 2019 to 7.0.2046.569 or later, and Subscription Edition to 7.0.2046.879 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify which of the three affected Microsoft Skype for Business Server product lines are deployed in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-603 – Use of Client-Side Authentication
View allShare
External POC / Exploit Code
Leaving vuln.today