Read the docs
TI-2026-48945 Aliases CVE-2026-69646GHSA-935c-p9xv-m74w

Skype for Business Spoofing Vulnerability

Priority LOW 38CWE-347Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.

Summary

Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0032 25th percentileScored 2026-11-07
Fix Fixed Microsoft: 3 updates

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftSkype for Business Server 2015 CU139319.0 to before 6.0.9319.8856.0.9319.885Patch availableCNA
MicrosoftSkype for Business Server 2019 CU82046.0 to before 7.0.2046.5697.0.2046.569Patch availableCNA
MicrosoftSkype for Business Server Subscription Edition CU12046.0 to before 7.0.2046.8797.0.2046.879Patch availableCNA
  • Skype for Business Server 2015 CU13 VendorMicrosoft Affected 9319.0 to before 6.0.9319.885 Fixed in 6.0.9319.885 Patch available CNA
  • Skype for Business Server 2019 CU8 VendorMicrosoft Affected 2046.0 to before 7.0.2046.569 Fixed in 7.0.2046.569 Patch available CNA
  • Skype for Business Server Subscription Edition CU1 VendorMicrosoft Affected 2046.0 to before 7.0.2046.879 Fixed in 7.0.2046.879 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*2015 cumulative_update_13VulnerableMicrosoft
cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13_hotfix_2:*:*:*:*:*:*2015 cumulative_update_13_hotfix_2VulnerableMicrosoft
cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8:*:*:*:*:*:*2019 cumulative_update_8VulnerableMicrosoft
cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix1:*:*:*:*:*:*2019 cumulative_update_8_hotfix1VulnerableMicrosoft
cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix2:*:*:*:*:*:*2019 cumulative_update_8_hotfix2VulnerableMicrosoft
cpe:2.3:a:microsoft:skype_for_business_server_subscription_edition:7.0.2046.849:*:*:*:*:*:*:*7.0.2046.849VulnerableMicrosoft
  • cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:* Versions 2015 cumulative_update_13 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13_hotfix_2:*:*:*:*:*:* Versions 2015 cumulative_update_13_hotfix_2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8:*:*:*:*:*:* Versions 2019 cumulative_update_8 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix1:*:*:*:*:*:* Versions 2019 cumulative_update_8_hotfix1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix2:*:*:*:*:*:* Versions 2019 cumulative_update_8_hotfix2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:skype_for_business_server_subscription_edition:7.0.2046.849:*:*:*:*:*:*:* Versions 7.0.2046.849 Vulnerable ·Microsoft

Remediation

Microsoft 3 updates

  • KB5123301
    Security Update
    • Skype for Business Server 2015 CU13 6.0.9319.885
  • KB5123300
    Security Update
    • Skype for Business Server 2019 CU8 7.0.2046.569
  • KB5123287
    Security Update
    • Skype for Business Server Subscription Edition CU1 7.0.2046.879

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Spoofing
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-69646
  2. 2026-10-03 Alias added: GHSA-935c-p9xv-m74w

References

Patch 1

  • TI-2023-22168 Skype for Business Elevation of Privilege Vulnerability KEVCVSS 3.1MEDIUM 5.3
  • TI-2026-47101 Skype for Business Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-47106 Skype for Business and Lync Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2026-47103 Skype for Business Information Disclosure Vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-18582 Skype for Business Remote Code Execution Vulnerability CVSS 3.1HIGH 7.2
  • TI-2023-18587 Skype for Business Remote Code Execution Vulnerability CVSS 3.1HIGH 7.2
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences