CVE-2026-66302 – Skype for Business Remote Code Execution Vulnerability

CVE-2026-66302 is a critical remote code execution vulnerability in affected Microsoft Skype for Business Server versions. External control of a file name or path allows an unauthenticated attacker to send a specially crafted network request that writes an attacker-controlled file to an arbitrary location on the server. Successful exploitation could allow code execution on the target server without authentication or user interaction.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability is remotely accessible over the network, has low attack complexity, and requires no privileges or user interaction. Successful exploitation could compromise confidentiality, integrity, and availability at a high level by allowing attacker-controlled code to execute on the affected server.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and the exploitability assessment is Exploitation Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability is caused by external control of a file name or path (CWE-73) in Skype for Business Server. An unauthenticated remote attacker can send a specially crafted request over the network that causes an attacker-controlled file to be written to an arbitrary location on the affected server. Successful exploitation can lead to execution of attacker-controlled code. The attack has low complexity, requires no existing privileges, and requires no action from a user. The security impact is rated High for confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products are Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU8, and Skype for Business Server Subscription Edition CU1. Exploitation can occur remotely through a specially crafted network request without authentication or user interaction.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on a Skype for Business server, potentially exposing sensitive information, altering server data or functionality, and disrupting service availability. Because no authentication or user interaction is required, an accessible vulnerable server could present a serious organizational risk.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, making patch deployment the documented remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8 and can be exploited over the network with low complexity, no privileges, and no user interaction. Although exploitation is currently assessed as less likely and no exploitation is reported, affected Skype for Business servers should be prioritized for deployment of the official fix because successful exploitation can result in remote code execution.