CVE-2026-66305
Undergoing Analysis
Undergoing Analysis - In Progress
Spoofing via Client-Side Authentication in Skype for Business
Vulnerability report for CVE-2026-66305, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-08
Last updated on: 2026-09-08
Assigner: Microsoft Corporation
Description
Description
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microsoft | skype_for_business | * |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-603 | A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check. |
