CVE-2026-63523
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
Risk Assessment
Risk of impersonating trusted content or users, potentially leading to fraud and data theft.
Recommendation
Update Skype for Business to the latest patched version and apply anti-XSS filters.
Other vulnerabilities in Skype for Business
See all- CVE-2026-66302Critical
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.
- CVE-2023-41763MediumActively exploited
Elevation of Privilege vulnerability in Skype for Business. Technical details are not available in the description.
- CVE-2026-69646High
Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.
- CVE-2026-69642Medium
A cross-site scripting (XSS) vulnerability in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-66308Medium
An out-of-bounds read vulnerability in Skype for Business allows an authorized attacker to deny service over a network.
- CVE-2026-66307High
Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.
- CVE-2026-66306Medium
A vulnerability in Skype for Business that generates error messages containing sensitive information allows an unauthorized attacker to disclose information over a network.
- CVE-2026-66305High
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.
- CVE-2026-66304High
Server-side request forgery (SSRF) in Skype for Business allows an unauthorized attacker to disclose information over a network.
- CVE-2026-66303Medium
A null pointer dereference vulnerability in Skype for Business allows an authorized attacker to deny service over a network.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.