Skype for Business and Lync Denial of Service Vulnerability

Microsoft · EN CVE-2026-66307 Important Action required CVSS 7.5

Published 8 sep 2026

Denial of Service. An attacker can make the service or server unavailable or slow.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
CVSS 7.5 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do? Install the security update for the version you run (or a later cumulative update):
- Skype for Business Server 2019 CU8: KB5123300 7.0.2046.569
- Skype for Business Server Subscription Edition CU1: KB5123287 7.0.2046.879
- Skype for Business Server 2015 CU13: KB5123301 6.0.9319.885

Skype for Business · Denial of Service

Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.

Key facts

Released

8 sep 2026

Impact

Denial of Service

Max severity

Important

Weakness

CVSS 3.1

7.5 / 6.5 (base / temporal)

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

Publicly disclosed

Exploited

Exploitability assessment

Exploitation Less Likely

Customer action required

Yes

Links

Product	Update	Build
Skype for Business Server 2019 CU8	KB5123300	`7.0.2046.569`
Skype for Business Server Subscription Edition CU1	KB5123287 · Security Update	`7.0.2046.879`
Skype for Business Server 2015 CU13	KB5123301	`6.0.9319.885`

Version	Date	Note
1	8 sep 2026	Information published.

This is in the weekly digest for week 37 · What changed this week? →

Source: Microsoft Security Update Guide. 365Fanatic is not affiliated with Microsoft.