Microsoft Skype For Business Server vulnerabilities
24 vulnerabilities
Known vulnerabilities in Microsoft Skype For Business Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-26422microsoftlync_server+4
EPSS score2.22%
Skype for Business and Lync Remote Code Execution VulnerabilityCVE-2021-26421microsoftlync_server+3EPSS score1.41%
Skype for Business and Lync Spoofing VulnerabilityCVE-2021-24099microsoftlync_server+4EPSS score3.20%
Skype for Business and Lync Denial of Service VulnerabilityCVE-2021-24073microsoftlync_server+3EPSS score1.80%
Skype for Business and Lync Spoofing VulnerabilityCVE-2015-2536microsoftlync_server+1EPSS score8.86%
Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability."CVE-2015-2531microsoftlync_server+1EPSS score10.89%
Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Information Disclosure Vulnerability."CVE-2022-26910microsoftskype_for_business_server+2EPSS score2.48%
Skype for Business and Lync Spoofing VulnerabilityCVE-2022-26911microsoftlync_server+4EPSS score3.63%
Skype for Business Information Disclosure VulnerabilityCVE-2024-20695microsoftskype_for_business_server+1EPSS score0.56%
Skype for Business Information Disclosure VulnerabilityCVE-2019-0798microsoftlync_server+3EPSS score2.08%
A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business and Lync Spoofing Vulnerability'.CVE-2026-63523microsoftskype_for_business_server+4EPSS score0.55%
Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.CVE-2026-66302microsoftskype_for_business_server+4EPSS score0.97%
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.CVE-2026-66303microsoftskype_for_business_server+4EPSS score1.14%
Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.CVE-2026-66304microsoftskype_for_business_server+4EPSS score0.97%
Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.CVE-2026-66307microsoftskype_for_business_server+4EPSS score1.17%
Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.CVE-2026-66305microsoftskype_for_business_server+4EPSS score0.53%
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.CVE-2026-66308microsoftskype_for_business_server+4EPSS score1.14%
Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.CVE-2026-66306microsoftskype_for_business_server+4EPSS score0.92%
Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.CVE-2026-69646microsoftskype_for_business_server+4EPSS score0.32%
Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.CVE-2026-69642microsoftskype_for_business_server+4EPSS score0.41%
Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.