CVE-2026-66304
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
Server-side request forgery (SSRF) in Skype for Business allows an unauthorized attacker to disclose information over a network.
Risk Assessment
Risk includes disclosure of sensitive information by making server send requests to internal resources. Attack can be performed remotely.
Recommendation
Apply security updates for Skype for Business. Restrict outbound network traffic and validate URLs.
Other vulnerabilities in Skype for Business
See all- CVE-2026-66302Critical
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.
- CVE-2023-41763MediumActively exploited
Elevation of Privilege vulnerability in Skype for Business. Technical details are not available in the description.
- CVE-2026-70297High
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
- CVE-2026-69646High
Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.
- CVE-2026-69642Medium
A cross-site scripting (XSS) vulnerability in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-66308Medium
An out-of-bounds read vulnerability in Skype for Business allows an authorized attacker to deny service over a network.
- CVE-2026-66307High
Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.
- CVE-2026-66306Medium
A vulnerability in Skype for Business that generates error messages containing sensitive information allows an unauthorized attacker to disclose information over a network.
- CVE-2026-66305High
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.
- CVE-2026-66303Medium
A null pointer dereference vulnerability in Skype for Business allows an authorized attacker to deny service over a network.
Original NVD description (English source)
Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS