CVE-2026-66305

CVE-2026-66305 is a spoofing vulnerability in Skype for Business caused by reliance on client-side authentication (CWE-603), meaning identity checks are enforced on the client rather than fully validated on the server side. An attacker who already holds valid, low-privileged credentials can trigger the flaw over the network without user interaction by manipulating the authentication flow to impersonate another user. Per the CVSS vector, successful spoofing carries a high integrity impact (communications or actions can appear to originate from another user), with low confidentiality impact and no availability impact. Organizations running the Skype for Business deployments identified in Microsoft's advisory are affected; specific affected version ranges are not enumerated in the available data. The flaw is not known to be exploited: there is no public proof of concept, it is absent from CISA's KEV catalog, and EPSS assigns a 0.3% probability of exploitation within 30 days (23rd percentile).

What to do: Check Microsoft's security advisory for this CVE to identify affected Skype for Business versions and apply the corresponding security update. Until patching is complete, restrict network access to Skype for Business services to trusted networks and review external/guest authentication settings, since exploitation requires valid low-privileged credentials. Monitor communications for signs of user impersonation or spoofed identities.