Skype for Business Server CVE-2026-66308

Exploitation requires valid network credentials: the CVSS PR:L metric confirms at minimum a low-privileged authenticated account is needed to reach the vulnerable code path. The attack is network-delivered (AV:N) and requires no user interaction beyond sending the crafted request. Exploitation is limited to on-premises Skype for Business Server deployments (2015, 2019, and Subscription Edition) running below the patched build numbers - cloud or Teams-only organizations are not affected. SSVC 'Automatable: no' indicates that credential acquisition forms a meaningful barrier preventing mass automated exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a network-reachable, low-complexity, authenticated DoS with no confidentiality or integrity impact, yielding a moderate 6.5 score. SSVC signals reinforce this: exploitation status is 'none', the attack is not automatable (PR:L gating requires credential acquisition), and technical impact is assessed as 'partial'. The combination of no public exploit, no KEV listing, and non-automatable exploitation suggests that even a mid-sized municipal IT team in legnica would reasonably classify this as a scheduled-patch rather than emergency-response item. The primary concern is availability of Skype for Business Server infrastructure, which in many organizations has already been partially or fully replaced by Microsoft Teams, further narrowing the real-world exposure.

An authenticated user - such as an internal employee or a federated partner with a valid account - sends a specially crafted SIP or related protocol message to the Skype for Business Server. The malformed message triggers an out-of-bounds read in the server process, causing it to crash and making the unified communications service unavailable to all connected users until the process restarts.