EUVD-2026-73934
GHSA-f56r-qvv6-jr8m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-reachable without authentication; UI:R for user-triggered error condition; C:H for sensitive data disclosure; no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Sensitive information disclosure via verbose error messages in Microsoft Skype for Business Server allows unauthenticated network attackers to capture confidential application data when a victim user triggers an error condition. Three on-premises server product lines are affected - the 2015, 2019, and Subscription Edition branches - with Microsoft-released patches available for all three. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a victim user to perform an interaction (UI:R) that triggers the vulnerable error path in Skype for Business Server - for example, following a crafted URL, processing a malformed session request, or interacting with an attacker-controlled resource that induces a server-side error response. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 base score reflects a network-accessible, unauthenticated vector with high confidentiality impact, but the UI:R constraint substantially limits real-world exploitability - a finding confirmed by SSVC's 'Automatable: no' determination. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available for all three affected product lines: upgrade Skype for Business Server 2015 to build 6.0.9319.885 or later, Skype for Business Server 2019 to build 7.0.2046.569 or later, and Skype for Business Server Subscription Edition to build 7.0.2046.879 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today