skype for business server vulnerabilities and fixes

Recent CVEs affecting skype for business server, with upgrade or downgrade steps. 10 tracked.

Also searched as: skypeforbusinessserver.

skype for business server has 10 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 1. Most recent: 2026-09-08. Highest priority: CVE-2026-66302 (score 63/100).

• CVE-2026-69646 HIGH 8.3 DOWNGRADE DOWNGRADE Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perf
• CVE-2026-69642 MEDIUM 6.5 DOWNGRADE DOWNGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business all
• CVE-2026-66308 MEDIUM 6.5 DOWNGRADE DOWNGRADE Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.
• CVE-2026-66307 HIGH 7.5 DOWNGRADE DOWNGRADE Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service o
• CVE-2026-66306 MEDIUM 6.5 DOWNGRADE DOWNGRADE Generation of error message containing sensitive information in Skype for Business allows an unauthorized atta
• CVE-2026-66305 HIGH 7.1 DOWNGRADE DOWNGRADE Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over
• CVE-2026-66304 HIGH 7.5 DOWNGRADE DOWNGRADE Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose informati
• CVE-2026-66303 MEDIUM 6.5 DOWNGRADE DOWNGRADE Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.
• CVE-2026-66302 CRITICAL 9.8 DOWNGRADE DOWNGRADE External control of file name or path in Skype for Business allows an unauthorized attacker to execute code ov
• CVE-2026-63523 MEDIUM 6.5 DOWNGRADE DOWNGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business all

FAQ

How do I fix skype for business server vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is skype for business server being exploited right now?

None of the tracked skype for business server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which skype for business server CVE should I patch first?

CVE-2026-66302 currently ranks highest (63/100): External control of file name or path in Skype for Business allows an unauthorized attacker to execute code ov.

RSS feed for skype for business server · ← Back to latest CVEs