Skype for Business Server CVE-2026-66306

Exploitation requires a victim user to perform an interaction (UI:R) that triggers the vulnerable error path in Skype for Business Server - for example, following a crafted URL, processing a malformed session request, or interacting with an attacker-controlled resource that induces a server-side error response. No authentication is required of the attacker (PR:N), but the user interaction requirement prevents fully automated mass exploitation. Exploitation is limited to on-premises deployments of the 2015, 2019, and Subscription Edition server branches at the affected build levels; Skype for Business Online is not affected. The attacker must be positioned to observe the disclosed error content, either by directly receiving the response or through a cross-origin context.

The CVSS 6.5 base score reflects a network-accessible, unauthenticated vector with high confidentiality impact, but the UI:R constraint substantially limits real-world exploitability - a finding confirmed by SSVC's 'Automatable: no' determination. SSVC rates technical impact as 'partial,' consistent with a read-only disclosure rather than a full system compromise primitive. No KEV listing exists, no public exploit code has been identified, and EPSS data was not provided in the available intelligence. The realistic risk profile is moderate: organizations running unpatched on-premises Skype for Business Server face potential exposure of sensitive application data when users interact with attacker-influenced requests or links, but the non-automatable nature rules out widespread opportunistic scanning campaigns. The product's declining deployment footprint - as organizations migrate to Microsoft Teams - means many remaining installations are legacy environments that may experience slower patch cycles, which modestly elevates the urgency relative to the raw score. The patch covers all three affected branch lines, leaving no ambiguity about the remediation path.

An attacker crafts a malicious link or embeds a request in content that, when accessed by a Skype for Business user, causes the server to generate an error response containing sensitive internal data such as tokens or configuration details. The attacker, positioned to receive or observe the error response, captures the disclosed information for use in further attacks such as session hijacking or targeted reconnaissance. No public exploit code exists, but CWE-209 vulnerabilities are straightforward to identify through targeted error-condition fuzzing.