CVE-2026-66305: Skype for Business Auth Bypass Vulnerability

CVE-2026-66305 Overview

CVE-2026-66305 is a spoofing vulnerability in Microsoft Skype for Business caused by reliance on client-side authentication [CWE-603]. An authorized attacker on the network can impersonate other users or services by manipulating authentication decisions performed on the client side. Microsoft published the advisory on September 8, 2026 through the Microsoft Security Update Guide.

The flaw affects integrity by allowing spoofed identities in a session that a trusting server or peer treats as authentic. Exploitation requires network access and low privileges but no user interaction, expanding the pool of viable attackers inside enterprise environments.

Critical Impact
A low-privileged network attacker can spoof identities in Skype for Business communications, undermining trust in messaging, presence, and conferencing sessions.

Affected Products

Microsoft Skype for Business (see the Microsoft Security Update Guide for exact build ranges)

Discovery Timeline

2026-09-08 - CVE-2026-66305 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-66305

Vulnerability Analysis

The vulnerability sits in the Skype for Business authentication flow, where security-relevant validation is executed on the client rather than enforced by the server. An authorized attacker with valid network access can bypass or forge identity claims by tampering with the client-side logic or the values it sends to peers. Because the trust boundary is misplaced, a manipulated client can present spoofed identity artifacts that downstream components accept as legitimate.

Exploitation results in a high impact to integrity, with limited confidentiality exposure and no direct availability impact. In practical terms, the attacker can appear as another user or service in chats, calls, meetings, or federated flows, enabling social engineering, business email compromise style pivots, and unauthorized access to shared resources. The EPSS probability at publication is 0.302%.

Root Cause

The root cause is client-side enforcement of authentication decisions [CWE-603]. Trust anchors that should be validated server side are handled by the client, allowing an attacker who controls or influences a client to assert an identity that the server accepts without independent verification.

Attack Vector

The attack vector is network based with low attack complexity and low privileges required. No user interaction is needed. An attacker with valid Skype for Business credentials or an authenticated foothold on the network can craft or replay authentication messages that cause peers or servers to attribute actions to a different principal.

No public proof-of-concept code is available for CVE-2026-66305. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-66305

Indicators of Compromise

Skype for Business sign-in or session events where the reported user identity does not match the source account, device, or network segment.
Presence, chat, or meeting activity attributed to a user during periods when that user has no legitimate active session.
Federated or external authentication requests from unexpected IP ranges or clients that do not match the organization's endpoint inventory.

Detection Strategies

Correlate Skype for Business server logs with Active Directory and Entra ID sign-in logs to identify mismatches between claimed identity and authenticating device.
Alert on anomalous client versions or user-agent strings interacting with Skype for Business front-end services.
Baseline normal conferencing and messaging patterns per user, and flag deviations such as impossible travel or concurrent sessions from disparate hosts.

Monitoring Recommendations

Ingest Skype for Business server, edge, and reverse proxy logs into a centralized analytics platform for continuous review.
Monitor federated SIP traffic and TLS handshake metadata for unexpected certificates or endpoints.
Track privilege changes and administrative actions performed through Skype for Business clients following the patch window.

How to Mitigate CVE-2026-66305

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Skype for Business servers and clients.
Inventory Skype for Business deployments, including edge servers and federated partners, to confirm patch coverage.
Rotate credentials and review recent session activity for accounts that show anomalous behavior tied to messaging or conferencing.

Patch Information

Microsoft has issued a security update for CVE-2026-66305. Administrators should consult the Microsoft Security Update Guide for the specific KB articles, affected build numbers, and installation guidance applicable to their Skype for Business version.

Workarounds

Restrict Skype for Business access to trusted network segments and enforce VPN or Zero Trust Network Access for remote users until patches are deployed.
Disable or tightly scope federation with external organizations that do not require it.
Enforce modern authentication and multi-factor authentication for all Skype for Business accounts to raise the bar for authorized attackers.

bash

# Example: verify installed Skype for Business server updates on Windows
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Example: list active Skype for Business user sessions for review
Get-CsUserSession -User "sip:user@example.com"