CVE-2026-66303: Skype for Business DOS Vulnerability

CVE-2026-66303 Overview

CVE-2026-66303 is a null pointer dereference vulnerability [CWE-476] in Microsoft Skype for Business. An authenticated attacker can trigger the flaw over a network to cause a denial of service (DoS) condition. The issue affects availability without impacting confidentiality or integrity. Microsoft published the advisory through its Security Update Guide.

Critical Impact
An authorized network attacker can crash Skype for Business services, disrupting enterprise communications and collaboration workflows.

Affected Products

Microsoft Skype for Business (see the Microsoft Security Update Guide for specific affected builds)

Discovery Timeline

2026-09-08 - CVE-2026-66303 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-66303

Vulnerability Analysis

The vulnerability is a null pointer dereference in Microsoft Skype for Business. When the service processes a specific network request, it dereferences a pointer without validating that the pointer is non-null. The dereference triggers an access violation, terminating the process and denying service to legitimate users.

Exploitation requires network access and valid low-privilege credentials. No user interaction is required. The impact is limited to availability, since confidentiality and integrity are unaffected. Repeated exploitation can produce sustained outages of collaboration services.

Root Cause

The root cause is missing null checks on a pointer prior to dereference within Skype for Business request-handling logic. Attacker-controlled input reaches a code path where the pointer is expected to reference a valid object but can legitimately be null under crafted conditions. Microsoft has not published detailed technical internals beyond the advisory reference.

Attack Vector

The attack is network-based and requires authentication. An attacker with a valid Skype for Business account sends a crafted request to the service. The malformed request drives the vulnerable code path, causing the null dereference and service crash. No privilege escalation or code execution is achieved.

See the Microsoft Security Update Guide for details on affected components and request patterns.

Detection Methods for CVE-2026-66303

Indicators of Compromise

Unexpected termination or restart of Skype for Business server processes correlated with inbound authenticated sessions.
Windows Application or System event log entries recording access violations in Skype for Business binaries.
Sudden loss of presence, IM, or conferencing availability for multiple users at the same time.

Detection Strategies

Monitor process crash telemetry on Skype for Business servers and alert on repeated faults from the same client identity or source address.
Correlate authentication logs with service restart events to identify authenticated users whose sessions precede crashes.
Baseline normal request patterns to Skype for Business endpoints and flag anomalous request payloads or malformed protocol messages.

Monitoring Recommendations

Enable Windows Error Reporting collection for Skype for Business processes and forward crash dumps to a central analysis pipeline.
Track service availability metrics and generate alerts when uptime deviates from established baselines.
Review authenticated session logs for accounts producing repeated malformed requests, which may indicate active exploitation attempts.

How to Mitigate CVE-2026-66303

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is available for your deployment.
Inventory all Skype for Business servers and confirm patch status across on-premises and hybrid environments.
Restrict Skype for Business access to trusted network segments where operationally feasible.

Patch Information

Microsoft addresses CVE-2026-66303 through updates distributed via the Security Update Guide. Administrators should consult the vendor advisory for specific KB numbers, product versions, and installation instructions. Validate patch deployment through Skype for Business version reporting after installation.

Workarounds

Enforce strict authentication controls and disable inactive Skype for Business accounts to reduce the pool of potential attackers.
Rate-limit authenticated Skype for Business requests at network intermediaries to slow repeated exploitation attempts.
Monitor and terminate sessions from accounts observed generating repeated malformed requests until patching is complete.

bash

# Verify Skype for Business patch level on a server
Get-CsServerVersion
Get-HotFix | Where-Object { $_.Description -like '*Skype*' } | Sort-Object InstalledOn -Descending