Skip to main content

Skype for Business EUVDEUVD-2026-73941

| CVE-2026-66307 HIGH
Integer Underflow (CWE-191)
2026-09-08 secure@microsoft.com GHSA-fmx2-865f-8c6j
Denial Of Service Microsoft Skype For Business Server Skype For Business Server Subscription Edition
7.5
CVSS 3.1 · Vendor: microsoft
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify reachable Skype for Business Server endpoint
  2. Delivery
    send crafted malformed network packet
  3. Exploit
    trigger integer underflow in input parser
  4. Execution
    value wraps to unexpected size
  5. Persist
    service process crashes
  6. Impact
    Skype for Business communications unavailable

Vulnerability Assessment

Weakness
CWE
CWE-191
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
Exploitation Conditions

No special configuration or privileges are required - the vulnerability is reachable by any unauthenticated attacker on the network who can send packets to a Skype for Business Server's network-facing ports. The CVSS vector confirms PR:N (no authentication) and AC:L (no special conditions). Exploitation is limited to the specific cumulative update baselines listed: Server 2019 CU8 prior to 7.0.2046.569, Server 2015 CU13 prior to 6.0.9319.885, and Subscription Edition CU1 prior to 7.0.2046.879. Systems patched to or beyond those versions are not affected. The impact is limited to availability only (denial of service); exploitation does not grant code execution or access to data based on available information.
Impact

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects network-reachable, unauthenticated service disruption. The impact is limited to availability - confidentiality and integrity are unaffected - making this a high-severity DoS rather than a critical compromise risk. SSVC signals are generally reassuring: exploitation status is none and technical impact is only partial, suggesting limited real-world uptake despite the automatable flag. No EPSS data was provided in this intelligence package and the vulnerability is not listed on the CISA KEV at time of analysis. The automatable=yes designation warrants attention for network defenders: a crafted packet can be sent without human interaction and with low complexity, meaning scripted scanning or spray attacks are feasible once triggering conditions are understood. No public exploit code has been identified. The primary concern is targeted disruption of enterprise communications infrastructure.
Exploit ScenarioDerived

An unauthenticated remote attacker sends a specially crafted network packet or SIP/HTTPS request to a Skype for Business Server's publicly or corporately-accessible communication endpoint. The malformed input triggers an integer underflow in the server's processing code, causing a value wrap-around that leads to a service crash or unhandled exception. The Skype for Business Server process becomes unavailable, disrupting voice, video, and messaging services for all users on that server until it is restarted.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 08, 2026

Unauthenticated network denial-of-service in Microsoft Skype for Business Server allows a remote attacker to crash the service by triggering an integer underflow (CWE-191) in network-facing processing code. Affected are Skype for Business Server 2015, 2019, and the Subscription Edition across specific cumulative update baselines. SSVC marks the vulnerability automatable with exploitation status none at time of analysis, and no public exploit code has been identified.

RemediationAI

Apply the vendor-released cumulative update patches from Microsoft: upgrade Skype for Business Server 2019 to version 7.0.2046.569 or later, Server 2015 to version 6.0.9319.885 or later, and Subscription Edition to version 7.0.2046.879 or later. Patch details and download links are available through the Microsoft Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66307. As a compensating control prior to patching, restricting network access to Skype for Business Server communication ports (typically 443, 5061, 5062, 5064-5069) via perimeter firewall or network ACLs to only trusted IP ranges can reduce exposure. Note that port-filtering may disrupt federated or external user communications. Internal-only deployments with strict network segmentation already limit the attack surface significantly.

Affected VersionsENISA

Skype for Business Server 2019 CU8 2046.0 <7.0.2046.569
Skype for Business Server 2015 CU13 9319.0 <6.0.9319.885
Skype for Business Server Subscription Edition CU1 2046.0 <7.0.2046.879

Affected Packages

euvd skype_for_business_server_2015_cu13 fix: 6.0.9319.885
euvd skype_for_business_server_2019_cu8 fix: 7.0.2046.569
euvd skype_for_business_server_subscription_edition_cu1 fix: 7.0.2046.879

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The root cause is CWE-191 (Integer Underflow - Wrap or Wraparound): an arithmetic operation produces a result smaller than the minimum representable value for the data type, causing the value to wrap around to a very large number or zero. In a network-facing parser or protocol handler, this kind of wrap can corrupt length calculations, leading to out-of-bounds reads, assertion failures, or unhandled exceptions that crash the service process. The vulnerability is network-reachable with no authentication required (CVSS AV:N/PR:N), making it directly triggerable from any adjacent or internet-routable host that can reach the Skype for Business Server's communication ports. Affected CPE baselines span three product lines: Server 2015 (CU13 9319.0 baseline, fixed at 6.0.9319.885), Server 2019 (CU8 2046.0 baseline, fixed at 7.0.2046.569), and Subscription Edition (CU1 2046.0 baseline, fixed at 7.0.2046.879).

Know when Skype For Business Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Network-reachable unauthenticated DoS with no auth, no user interaction, and pure availability impact; vendor-provided vector is accurate.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Sep 08, 2026 - 19:35 EUVD
CVE Published
Sep 08, 2026 - 19:18 cve.org
HIGH 7.5

DescriptionCVE.org

Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.

Executive ViewAI

Why It Matters

Microsoft Skype for Business Server 2015, 2019, and Subscription Edition are vulnerable to an unauthenticated denial-of-service attack that can crash the communication service, disrupting organizational messaging and collaboration. This directly threatens business continuity and user productivity for any organization relying on Skype for internal communication.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.6%
Top 51% exploitable
Prevalence
Medium
enterprise collaboration server, declining footprint as Teams displaces it
Vendor Status
Publicly Disclosed:No
Exploited:No
Latest Software Release:Exploitation Less Likely
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment MSRC VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Skype For Business Server

View all
CVE-2026-66302 CRITICAL
9.8 Sep 08

Remote code execution in Microsoft Skype for Business Server (2015 CU13, 2019 CU8, and Subscription Edition CU1) lets an
CVE-2023-41763 MEDIUM POC
5.3 Oct 10

Skype for Business Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotel
CVE-2026-69646 HIGH
8.3 Sep 08

Skype for Business Server's failure to properly verify cryptographic signatures (CWE-347) enables unauthenticated attack
CVE-2026-66304 HIGH
7.5 Sep 08

Server-side request forgery in Microsoft Skype for Business Server exposes internal network resources to unauthenticated
CVE-2023-36789 HIGH
7.2 Oct 10

Skype for Business Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely e
CVE-2023-36786 HIGH
7.2 Oct 10

Skype for Business Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely e
CVE-2023-36780 HIGH
7.2 Oct 10

Skype for Business Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely e
CVE-2021-26422 HIGH
7.2 May 11

Skype for Business and Lync Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is r
CVE-2026-66305 HIGH
7.1 Sep 08

Client-side authentication bypass in Microsoft Skype for Business Server enables a low-privileged network attacker to pe
CVE-2015-2531 MEDIUM
4.3 Sep 09

Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Serve
CVE-2026-66303 MEDIUM
6.5 Sep 08

Null pointer dereference in Microsoft Skype for Business Server allows any authenticated low-privilege user to crash the
CVE-2026-66308 MEDIUM
6.5 Sep 08

Out-of-bounds read in Skype for Business Server enables authenticated network attackers to crash the service, causing a

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-66307 ADVISORY https://vuldb.com/vuln/400234 REF https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66307

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy