CVE-2026-66304 Overview
CVE-2026-66304 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Skype for Business. The flaw allows an unauthenticated remote attacker to coerce the server into issuing requests to attacker-chosen destinations, resulting in disclosure of information over a network. The vulnerability is categorized under [CWE-918] and affects the confidentiality of data accessible to the Skype for Business server. No user interaction or prior authentication is required to exploit the issue.
Critical Impact
An unauthorized network attacker can abuse SSRF in Skype for Business to disclose sensitive information reachable by the vulnerable server, including internal service metadata and content behind trusted network boundaries.
Affected Products
- Microsoft Skype for Business (see the Microsoft Security Update Guide for supported version details)
Discovery Timeline
- 2026-09-08 - CVE-2026-66304 published to the National Vulnerability Database
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-66304
Vulnerability Analysis
The vulnerability is a Server-Side Request Forgery flaw in Skype for Business. The affected server accepts input that influences the destination of an outbound HTTP or protocol request and issues that request without adequate validation. An attacker submits a crafted request over the network to induce the server to fetch or interact with an arbitrary URL. The response, response metadata, or observable side effects then leak information back to the attacker.
Because the attack is executed by the server itself, requests originate from a trusted network position. This position frequently grants access to internal services, cloud instance metadata endpoints, and management interfaces that block direct external access. The vulnerability affects confidentiality only, with no direct impact on integrity or availability of the Skype for Business service.
Root Cause
The root cause is insufficient validation of URLs or destination identifiers used by a server-side request handler [CWE-918]. When the target of an outbound request is derived from untrusted input without allow-list enforcement or network segmentation checks, the server can be redirected to unintended destinations.
Attack Vector
Exploitation requires only network access to a reachable Skype for Business endpoint. No authentication and no user interaction are required. The attacker submits a request containing a manipulated URL or resource reference. The server then contacts the specified destination and returns information observable to the attacker. Refer to the Microsoft Security Update Guide for protocol-specific technical details.
No public proof-of-concept exploit code is available at the time of publication.
Detection Methods for CVE-2026-66304
Indicators of Compromise
- Outbound HTTP or HTTPS connections from Skype for Business server processes to non-standard destinations, including internal RFC 1918 ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
- Anomalous DNS lookups initiated by the Skype for Business host for external attacker-controlled domains.
- Unusual spikes in outbound request volume from the Skype for Business front-end or edge role.
Detection Strategies
- Inspect web and proxy logs for outbound requests from Skype for Business hosts targeting internal-only IP ranges or metadata services.
- Correlate inbound Skype for Business requests containing URL-like parameters with subsequent outbound connections from the same host.
- Alert on egress traffic from Skype for Business servers that deviates from the documented set of required outbound destinations.
Monitoring Recommendations
- Enable verbose logging on the Skype for Business front-end and edge components and forward logs to a centralized analytics platform.
- Monitor process-level network telemetry for the Skype for Business service accounts to detect unexpected destinations.
- Track DNS resolution patterns from Skype for Business hosts and flag first-seen or low-reputation domains.
How to Mitigate CVE-2026-66304
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-66304.
- Inventory all Skype for Business deployments, including edge and front-end servers, and confirm patch status.
- Restrict outbound network access from Skype for Business hosts to only the destinations required for operation.
Patch Information
Microsoft has published guidance and update details in the Microsoft Security Update Guide. Administrators should consult the advisory for the specific update packages that address CVE-2026-66304 in their deployed version of Skype for Business.
Workarounds
- Place Skype for Business servers behind an egress proxy that enforces an allow-list of permitted outbound destinations.
- Block outbound access from Skype for Business hosts to internal management networks and to cloud metadata endpoints such as 169.254.169.254.
- Restrict inbound network exposure of Skype for Business endpoints to trusted client networks where operationally feasible.
# Example egress restriction: block cloud metadata endpoint from a Skype for Business host
# Windows Advanced Firewall rule
New-NetFirewallRule -DisplayName "Block IMDS from S4B" -Direction Outbound `
-RemoteAddress 169.254.169.254 -Action Block -Profile Any
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.