Skype for Business EUVD-2026-73939

Exploitation requires network adjacency: the attacker must reside on the same network segment, subnet, or VLAN as the Skype for Business Server at the time of the attack, consistent with the CVSS AV:A metric. No authentication or user interaction is required once network position is achieved (PR:N, UI:N). The flaw is present only in on-premises Skype for Business Server deployments - specifically SfB Server 2015 CU13 below build 6.0.9319.885, SfB Server 2019 CU8 below build 7.0.2046.569, and SfB Server Subscription Edition CU1 below build 7.0.2046.879. Exploitation is limited by: (1) the requirement for network adjacency rather than arbitrary internet-facing access, (2) scope restricted to on-premises server deployments (cloud SfB Online and Teams are not listed), and (3) unpatched installations within the named cumulative-update baselines only.

The CVSS 8.3 score reflects a genuine and serious threat: adjacent-network, unauthenticated access requiring no user interaction, with high confidentiality and integrity impact and only low availability impact. The primary real-world constraint is network adjacency - the attacker must occupy the same segment as the SfB Server, which in enterprise environments typically means a compromised internal host, a malicious insider, or an attacker who has gained LAN access. No EPSS data was provided and no CISA KEV listing exists, so exploitation frequency is unknown; however, the SSVC signals (automatable once adjacent, high technical impact via identity spoofing) warrant treating this as a high-priority patch target. Even a mid-sized IT operations team running on-premises unified communications infrastructure should treat this as urgent given that spoofing could enable persistent credential theft or interception of confidential business communications. The absence of scope change (S:U) contains the blast radius to the SfB deployment itself, limiting lateral risk to other systems - but the high integrity and confidentiality impact within that scope is substantial. The JWT Attack tag narrows the attack surface to the token-validation pathway, which is a well-understood attack class with known tooling.

An attacker who has compromised an endpoint on the same corporate LAN segment as the Skype for Business Server infrastructure crafts a JWT bearing a forged or absent cryptographic signature and presents it to the SfB signaling endpoint. The server, failing to properly verify the signature, accepts the token as authentic, allowing the attacker to impersonate a legitimate user or trusted server peer and intercept or inject communications. A public proof-of-concept for JWT algorithm-confusion or 'none'-algorithm attacks against similar platforms is widely documented, though no exploit specific to this CVE has been confirmed.