CVE-2026-69642
Undergoing Analysis Undergoing Analysis - In Progress

Cross-Site Scripting in Skype for Business

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Microsoft Corporation

Description
Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-08
Last Modified
2026-09-08
Generated
2026-09-09
AI Q&A
2026-09-09
EPSS Evaluated
N/A
NVD
CVE-2026-69642

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
microsoft skype_for_business *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in Skype for Business. It occurs when user input is not properly neutralized during web page generation, allowing an attacker to inject malicious scripts into web pages viewed by other users. This can lead to spoofing attacks where the attacker impersonates legitimate users or websites.

Impact Analysis

This vulnerability could allow an attacker to steal sensitive information like session cookies, login credentials, or personal data from users. It may also enable the attacker to perform actions on behalf of the user, such as sending unauthorized messages or accessing restricted content.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA requirements for protecting personal and health information. Organizations using Skype for Business may face compliance violations, legal penalties, and reputational damage if this flaw is exploited.

Mitigation Strategies

Apply the latest security updates from Microsoft for Skype for Business to patch the XSS vulnerability. Disable unnecessary web features in Skype for Business if updates are not immediately available. Monitor network traffic for suspicious activity related to cross-site scripting attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69642. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart