Critical 9.8Published Sep 8, 2026

CVE-2026-66302Skype for Business Remote Code Execution Vulnerability

Updated under an hour ago (2026-10-19 08:00 UTC)

Does this affect you?

It affects Microsoft Skype for Business Server 2015 CU13 and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Microsoft Skype for Business Server 2015 CU13

Exploited in the last 30 days

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Weakness (CWE): CWE-73
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: microsoft
NVD analysis: Analyzed
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Microsoft Skype for Business Server 2015 CU13 microsoft:skype_for_business_server_2015_cu13 (from the name)	9319.0 builds before 6.0.9319.885	CNA record
Microsoft Skype for Business Server 2019 CU8 microsoft:skype_for_business_server_2019_cu8 (from the name)	2046.0 builds before 7.0.2046.569	CNA record
Microsoft Skype for Business Server Subscription Edition CU1 microsoft:skype_for_business_server_subscription_edition_cu1 (from the name)	2046.0 builds before 7.0.2046.879	CNA record
microsoft skype_for_business_server microsoft:skype_for_business_server	2015; 2015; 2019; 2019; 2019	NVD
microsoft skype_for_business_server_subscription_edition microsoft:skype_for_business_server_subscription_edition	7.0.2046.849	NVD

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66302vendor-advisory, patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.