Microsoft Skype For Business Server vulnerabilities

24 CVEs affecting Microsoft Skype For Business Server, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-69646, published 2026-09-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-41763: Microsoft Skype for Business Privilege Escalation Vulnerability, published 2023-10-10. Medium severity, CVSS 5.3. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 90.5% chance of exploitation in the next 30 days. Skype for Business Elevation of Privilege Vulnerability
• CVE-2015-2531, published 2015-09-09. Medium severity, CVSS 4.3. EPSS: 10.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a…
• CVE-2015-2536, published 2015-09-09. Medium severity, CVSS 4.3. EPSS: 8.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype…
• CVE-2022-26911, published 2022-04-15. Medium severity, CVSS 6.5. EPSS: 3.6% chance of exploitation in the next 30 days. Skype for Business Information Disclosure Vulnerability
• CVE-2021-24099, published 2021-02-25. Medium severity, CVSS 6.5. EPSS: 3.2% chance of exploitation in the next 30 days. Skype for Business and Lync Denial of Service Vulnerability
• CVE-2023-36780, published 2023-10-10. High severity, CVSS 7.2. EPSS: 2.7% chance of exploitation in the next 30 days. Skype for Business Remote Code Execution Vulnerability
• CVE-2023-36786, published 2023-10-10. High severity, CVSS 7.2. EPSS: 2.6% chance of exploitation in the next 30 days. Skype for Business Remote Code Execution Vulnerability
• CVE-2023-36789, published 2023-10-10. High severity, CVSS 7.2. EPSS: 2.5% chance of exploitation in the next 30 days. Skype for Business Remote Code Execution Vulnerability
• CVE-2022-26910, published 2022-04-15. Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days. Skype for Business and Lync Spoofing Vulnerability
• CVE-2021-26422, published 2021-05-11. High severity, CVSS 7.2. EPSS: 2.2% chance of exploitation in the next 30 days. Skype for Business and Lync Remote Code Execution Vulnerability

Latest

• CVE-2026-69646, published 2026-09-08. High severity, CVSS 8.3. EPSS: 0.3% chance of exploitation in the next 30 days. Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.
• CVE-2026-69642, published 2026-09-08. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-66308, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.
• CVE-2026-66307, published 2026-09-08. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.
• CVE-2026-66306, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.
• CVE-2026-66305, published 2026-09-08. High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days. Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.
• CVE-2026-66304, published 2026-09-08. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.
• CVE-2026-66303, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.
• CVE-2026-66302, published 2026-09-08. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.
• CVE-2026-63523, published 2026-09-08. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.