CVE-2026-69646: Skype for Business Spoofing Vulnerability

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-08 · updated 2026-10-14
Weakness: CWE-347

Description

Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.

Affected products

Microsoft Skype for Business Server 2019 CU7: 2015-cumulative_update_13, 2015-cumulative_update_13_hotfix_2, 2019-cumulative_update_8, 2019-cumulative_update_8_hotfix1, 2019-cumulative_update_8_hotfix2
Microsoft Skype For Business Server Subscription Edition: 7.0.2046.849
Microsoft Skype for Business Server 2015 CU13: from 9319.0 before 6.0.9319.885 — fixed in 6.0.9319.885
Microsoft Skype for Business Server 2019 CU8: from 2046.0 before 7.0.2046.569 — fixed in 7.0.2046.569
Microsoft Skype for Business Server Subscription Edition CU1: from 2046.0 before 7.0.2046.879 — fixed in 7.0.2046.879

How to fix

Upgrade to a fixed version: Microsoft Skype for Business Server 2015 CU13 6.0.9319.885; Microsoft Skype for Business Server 2019 CU8 7.0.2046.569; Microsoft Skype for Business Server Subscription Edition CU1 7.0.2046.879. Check the vendor advisory for mitigations.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69646

Get alerted when CVE-2026-69646 or the next vulnerability affects your stack