Skype for Business CVE-2026-69642

The vulnerability affects on-premises Skype for Business Server deployments only; organizations fully migrated to Microsoft Teams cloud services are not affected. The CVSS vector (AV:N/AC:L/PR:N) indicates the vulnerable web endpoints are network-reachable with no attacker privileges required. The UI:N metric is inconsistent with typical reflected XSS behavior - if the vulnerability is actually stored XSS, no victim interaction beyond page navigation is needed; if reflected, a victim must load a crafted URL, which limits opportunistic exploitation. Exploitation risk is substantially reduced if web interfaces are restricted to internal networks via firewall or reverse proxy. All three affected product lines must be running a build prior to the patched cumulative update versions to be vulnerable.

The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) represents moderate severity with notable caveats. The UI:N metric is atypical for CWE-79 XSS, which ordinarily requires a victim to load or interact with attacker-supplied content (UI:R); this may indicate a stored XSS variant where the payload executes passively upon page load, or it may represent an error in the scoring submission - this discrepancy should be verified against the MSRC advisory. No EPSS data, KEV listing, or known public exploit is present in the provided intelligence, placing real-world exploitation pressure below the theoretical CVSS ceiling. Exposure is further bounded by deployment model: organizations that restrict Skype for Business Server web interfaces to internal networks substantially reduce the attack surface, whereas internet-facing deployments with unauthenticated access to web components face meaningful risk.

An unauthenticated remote attacker submits a crafted payload to a Skype for Business Server web component - such as a meeting scheduler or conferencing portal - that stores or reflects the input without sanitization. When a victim user accesses the affected page, the injected script executes in their browser, enabling the attacker to render spoofed UI elements, redirect the user to a phishing site, or capture limited session context. No public exploit code has been identified, but the low attack complexity suggests this is straightforward to reproduce once the specific injection point is identified.