CVE-2026-63523

Undergoing Analysis Undergoing Analysis - In Progress

Cross-Site Scripting in Skype for Business

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Microsoft Corporation

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-63523

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	skype_for_business	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a cross-site scripting (XSS) vulnerability in Skype for Business where improper input handling allows an attacker to inject malicious scripts into web pages. The attacker can then perform spoofing attacks over a network.

Impact Analysis

An attacker could exploit this to steal user sessions, impersonate users, or deliver malware. Users might see unauthorized content or have their interactions manipulated without their knowledge.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties.

Mitigation Strategies

Apply the latest security updates from Microsoft for Skype for Business to patch the XSS vulnerability. Monitor Skype for Business logs for suspicious input patterns or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-63523. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70