Skype For Business Server
Monthly
Skype for Business Server's failure to properly verify cryptographic signatures (CWE-347) enables unauthenticated attackers on the same network segment to spoof identities or server endpoints, achieving high confidentiality and integrity impact across three distinct server release lines. All on-premises deployments of SfB Server 2015 CU13, 2019 CU8, and Subscription Edition CU1 below specific cumulative-update thresholds are confirmed affected, with patched releases available from Microsoft. The JWT Attack tag combined with CWE-347 indicates the flaw resides in token signature validation, where the server may accept cryptographically forged or unsigned tokens as legitimate - enabling impersonation without valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated network denial-of-service in Microsoft Skype for Business Server allows a remote attacker to crash the service by triggering an integer underflow (CWE-191) in network-facing processing code. Affected are Skype for Business Server 2015, 2019, and the Subscription Edition across specific cumulative update baselines. SSVC marks the vulnerability automatable with exploitation status none at time of analysis, and no public exploit code has been identified.
Client-side authentication bypass in Microsoft Skype for Business Server enables a low-privileged network attacker to perform identity spoofing against other users on the platform. The flaw stems from CWE-603 (Use of Client-Side Authentication), where the server delegates trust to client-controlled data, allowing an authenticated user to forge session identity and corrupt integrity of communications. Three supported server product lines are affected with vendor patches now available; no public exploit or active exploitation has been identified at time of analysis.
Server-side request forgery in Microsoft Skype for Business Server exposes internal network resources to unauthenticated remote attackers. Three server product lines are affected - Subscription Edition, 2015 (CU13), and 2019 (CU8) - all running builds below their respective patched versions. An attacker with network access to the server can forge requests through the server to enumerate or exfiltrate data from internal systems, with no public exploit identified at time of analysis.
Remote code execution in Microsoft Skype for Business Server (2015 CU13, 2019 CU8, and Subscription Edition CU1) lets an unauthenticated network attacker run arbitrary code by controlling a file name or path processed by the server (CWE-73). The flaw was reported by Microsoft's own MSRC team and a patch is available; there is no public exploit identified at time of analysis and no CISA KEV listing, but the pre-authentication, network-reachable RCE profile makes it a top-priority patch for any on-premises deployment.
Skype for Business Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Cross-site scripting in on-premises Skype for Business Server enables network-accessible spoofing attacks across three supported server generations. The CVSS 6.5 rating reflects limited confidentiality and integrity impact, consistent with content-injection or UI-spoofing outcomes rather than full session takeover. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Out-of-bounds read in Skype for Business Server enables authenticated network attackers to crash the service, causing a denial of service. Affected are on-premises deployments of Skype for Business Server 2015, 2019, and the Subscription Edition - all unpatched below the versions specified in Microsoft's July 2026 advisory. No public exploit code has been identified and CISA has not placed this in the KEV catalog, placing it in the lower-priority tier despite the network-accessible attack vector.
Sensitive information disclosure via verbose error messages in Microsoft Skype for Business Server allows unauthenticated network attackers to capture confidential application data when a victim user triggers an error condition. Three on-premises server product lines are affected - the 2015, 2019, and Subscription Edition branches - with Microsoft-released patches available for all three. No public exploit code or active exploitation has been identified; SSVC assessment rates the attack as non-automatable with partial technical impact.
Null pointer dereference in Microsoft Skype for Business Server allows any authenticated low-privilege user to crash the server over the network, causing a complete denial of communications service. Three on-premises product lines are affected: Server 2015 CU13, Server 2019 CU8, and Subscription Edition CU1. No active exploitation is confirmed - SSVC rates exploitation as none and the attack is not automatable - but the low authentication bar (any valid SfB user account) makes this a credible insider threat or compromised-credential scenario.
Cross-site scripting in Microsoft Skype for Business Server enables network-based spoofing against authenticated users across three distinct server product lines. An unauthenticated remote attacker can inject malicious script into a vulnerable web component that executes in a victim's browser upon user interaction, resulting in high-confidentiality-impact session token theft or UI-level spoofing consistent with the CVSS C:H/I:N pairing. Vendor-released patches are confirmed available via MSRC; no public exploit code and no CISA KEV listing exist at time of analysis.
Skype for Business Information Disclosure Vulnerability. Rated medium severity (CVSS 5.7), this vulnerability is low attack complexity.
Skype for Business Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Skype for Business Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Skype for Business Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Skype for Business Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Skype for Business and Lync Spoofing Vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Skype for Business and Lync Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Skype for Business and Lync Spoofing Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable.
Skype for Business and Lync Denial of Service Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Skype for Business and Lync Spoofing Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable.
A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business and Lync Spoofing Vulnerability'. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 13.2% and no vendor patch available.
Skype for Business Server's failure to properly verify cryptographic signatures (CWE-347) enables unauthenticated attackers on the same network segment to spoof identities or server endpoints, achieving high confidentiality and integrity impact across three distinct server release lines. All on-premises deployments of SfB Server 2015 CU13, 2019 CU8, and Subscription Edition CU1 below specific cumulative-update thresholds are confirmed affected, with patched releases available from Microsoft. The JWT Attack tag combined with CWE-347 indicates the flaw resides in token signature validation, where the server may accept cryptographically forged or unsigned tokens as legitimate - enabling impersonation without valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated network denial-of-service in Microsoft Skype for Business Server allows a remote attacker to crash the service by triggering an integer underflow (CWE-191) in network-facing processing code. Affected are Skype for Business Server 2015, 2019, and the Subscription Edition across specific cumulative update baselines. SSVC marks the vulnerability automatable with exploitation status none at time of analysis, and no public exploit code has been identified.
Client-side authentication bypass in Microsoft Skype for Business Server enables a low-privileged network attacker to perform identity spoofing against other users on the platform. The flaw stems from CWE-603 (Use of Client-Side Authentication), where the server delegates trust to client-controlled data, allowing an authenticated user to forge session identity and corrupt integrity of communications. Three supported server product lines are affected with vendor patches now available; no public exploit or active exploitation has been identified at time of analysis.
Server-side request forgery in Microsoft Skype for Business Server exposes internal network resources to unauthenticated remote attackers. Three server product lines are affected - Subscription Edition, 2015 (CU13), and 2019 (CU8) - all running builds below their respective patched versions. An attacker with network access to the server can forge requests through the server to enumerate or exfiltrate data from internal systems, with no public exploit identified at time of analysis.
Remote code execution in Microsoft Skype for Business Server (2015 CU13, 2019 CU8, and Subscription Edition CU1) lets an unauthenticated network attacker run arbitrary code by controlling a file name or path processed by the server (CWE-73). The flaw was reported by Microsoft's own MSRC team and a patch is available; there is no public exploit identified at time of analysis and no CISA KEV listing, but the pre-authentication, network-reachable RCE profile makes it a top-priority patch for any on-premises deployment.
Skype for Business Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Cross-site scripting in on-premises Skype for Business Server enables network-accessible spoofing attacks across three supported server generations. The CVSS 6.5 rating reflects limited confidentiality and integrity impact, consistent with content-injection or UI-spoofing outcomes rather than full session takeover. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Out-of-bounds read in Skype for Business Server enables authenticated network attackers to crash the service, causing a denial of service. Affected are on-premises deployments of Skype for Business Server 2015, 2019, and the Subscription Edition - all unpatched below the versions specified in Microsoft's July 2026 advisory. No public exploit code has been identified and CISA has not placed this in the KEV catalog, placing it in the lower-priority tier despite the network-accessible attack vector.
Sensitive information disclosure via verbose error messages in Microsoft Skype for Business Server allows unauthenticated network attackers to capture confidential application data when a victim user triggers an error condition. Three on-premises server product lines are affected - the 2015, 2019, and Subscription Edition branches - with Microsoft-released patches available for all three. No public exploit code or active exploitation has been identified; SSVC assessment rates the attack as non-automatable with partial technical impact.
Null pointer dereference in Microsoft Skype for Business Server allows any authenticated low-privilege user to crash the server over the network, causing a complete denial of communications service. Three on-premises product lines are affected: Server 2015 CU13, Server 2019 CU8, and Subscription Edition CU1. No active exploitation is confirmed - SSVC rates exploitation as none and the attack is not automatable - but the low authentication bar (any valid SfB user account) makes this a credible insider threat or compromised-credential scenario.
Cross-site scripting in Microsoft Skype for Business Server enables network-based spoofing against authenticated users across three distinct server product lines. An unauthenticated remote attacker can inject malicious script into a vulnerable web component that executes in a victim's browser upon user interaction, resulting in high-confidentiality-impact session token theft or UI-level spoofing consistent with the CVSS C:H/I:N pairing. Vendor-released patches are confirmed available via MSRC; no public exploit code and no CISA KEV listing exist at time of analysis.
Skype for Business Information Disclosure Vulnerability. Rated medium severity (CVSS 5.7), this vulnerability is low attack complexity.
Skype for Business Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Skype for Business Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Skype for Business Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Skype for Business Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Skype for Business and Lync Spoofing Vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Skype for Business and Lync Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Skype for Business and Lync Spoofing Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable.
Skype for Business and Lync Denial of Service Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Skype for Business and Lync Spoofing Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable.
A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business and Lync Spoofing Vulnerability'. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 13.2% and no vendor patch available.