Read the docs
TI-2022-10142 Aliases CVE-2022-26910GHSA-gq3f-cc5w-p8w5

Skype for Business and Lync Spoofing Vulnerability

Priority LOW 35CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.

Summary

Skype for Business and Lync Spoofing Vulnerability

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02477 84th percentileScored 2026-11-07
Fix Fixed Microsoft: 1 update

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftSkype for Business Server 2015 CU129319.0 to before 9319.6289319.628Patch availableCNA
MicrosoftSkype for Business Server 2019 CU62046.0 to before 2046.3962046.396Patch availableCNA
  • Skype for Business Server 2015 CU12 VendorMicrosoft Affected 9319.0 to before 9319.628 Fixed in 9319.628 Patch available CNA
  • Skype for Business Server 2019 CU6 VendorMicrosoft Affected 2046.0 to before 2046.396 Fixed in 2046.396 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:skype_for_business_server:2015:cu12:*:*:*:*:*:*2015 cu12VulnerableMicrosoft
cpe:2.3:a:microsoft:skype_for_business_server:2019:cu6:*:*:*:*:*:*2019 cu6VulnerableMicrosoft
  • cpe:2.3:a:microsoft:skype_for_business_server:2015:cu12:*:*:*:*:*:* Versions 2015 cu12 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:skype_for_business_server:2019:cu6:*:*:*:*:*:* Versions 2019 cu6 Vulnerable ·Microsoft

Remediation

Microsoft 1 update

  • KB5012686
    Security Update
    • Skype for Business Server 2015 CU12 9319.628
    • Skype for Business Server 2019 CU6 2046.396, 9319.628

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Spoofing
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26910
  2. 2026-10-03 Alias added: GHSA-gq3f-cc5w-p8w5

References

Advisory 1

  • TI-2023-22168 Skype for Business Elevation of Privilege Vulnerability KEVCVSS 3.1MEDIUM 5.3
  • TI-2026-47101 Skype for Business Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-47106 Skype for Business and Lync Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2026-47103 Skype for Business Information Disclosure Vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-18582 Skype for Business Remote Code Execution Vulnerability CVSS 3.1HIGH 7.2
  • TI-2026-48945 Skype for Business Spoofing Vulnerability CVSS 3.1HIGH 8.3
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences