Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.
zetlyn/cve-nvd vulnerability cve CVE-2026-66306 cpe cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:* cpe cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13_hotfix_2:*:*:*:*:*:* cpe cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8:*:*:*:*:*:* cpe cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix1:*:*:*:*:*:* cpe cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix2:*:*:*:*:*:* cpe cpe:2.3:a:microsoft:skype_for_business_server_subscription_edition:7.0.2046.849:*:*:*:*:*:*:* known 2026-09-08
https://nvd.nist.gov/vuln/detail/CVE-2026-66306
Properties
| cvss | 6.5receipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"platforms": [
"x64-based Systems"
],
"product": "Skype for Business Server 2015 CU13",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.0.9319.885",
"status": "affected",
"version": "9319.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Skype for Business Server 2019 CU8",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.0.2046.569",
"status": "affected",
"version": "2046.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Skype for Business Server Subscription Edition CU1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.0.2046.879",
"status": "affected",
"version": "2046.0",
"versionType": "custom"
}
]
}
],
"source": "secure@microsoft.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*",
"matchCriteriaId": "590D1547-C998-4BDD-BE06-379099E2D9C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13_hotfix_2:*:*:*:*:*:*",
"matchCriteriaId": "D7B2DE75-E220-447A-90F6-D077E611945B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8:*:*:*:*:*:*",
"matchCriteriaId": "85821F4F-AC9B-4D9E-84A4-A57D842B0D5E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix1:*:*:*:*:*:*",
"matchCriteriaId": "8545EA2E-796F-4458-B996-5B907E7927EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix2:*:*:*:*:*:*",
"matchCriteriaId": "96E5BC34-2C62-4F15-AA4F-765F596C7445",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server_subscription_edition:7.0.2046.849:*:*:*:*:*:*:*",
"matchCriteriaId": "15BD78C6-A65A-4CD6-A91F-CA2876AD848C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network."
}
],
"id": "CVE-2026-66306",
"lastModified": "2026-09-16T19:24:24.507",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "secure@microsoft.com",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-66306",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:52:48.290572Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-08T19:18:08.200",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66306"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "secure@microsoft.com",
"type": "Primary"
}
]
}
} | ||||
|---|---|---|---|---|---|
| product | Skype for Business Server 2015 CU13receipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"platforms": [
"x64-based Systems"
],
"product": "Skype for Business Server 2015 CU13",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.0.9319.885",
"status": "affected",
"version": "9319.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Skype for Business Server 2019 CU8",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.0.2046.569",
"status": "affected",
"version": "2046.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Skype for Business Server Subscription Edition CU1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.0.2046.879",
"status": "affected",
"version": "2046.0",
"versionType": "custom"
}
]
}
],
"source": "secure@microsoft.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*",
"matchCriteriaId": "590D1547-C998-4BDD-BE06-379099E2D9C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13_hotfix_2:*:*:*:*:*:*",
"matchCriteriaId": "D7B2DE75-E220-447A-90F6-D077E611945B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8:*:*:*:*:*:*",
"matchCriteriaId": "85821F4F-AC9B-4D9E-84A4-A57D842B0D5E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix1:*:*:*:*:*:*",
"matchCriteriaId": "8545EA2E-796F-4458-B996-5B907E7927EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix2:*:*:*:*:*:*",
"matchCriteriaId": "96E5BC34-2C62-4F15-AA4F-765F596C7445",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server_subscription_edition:7.0.2046.849:*:*:*:*:*:*:*",
"matchCriteriaId": "15BD78C6-A65A-4CD6-A91F-CA2876AD848C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network."
}
],
"id": "CVE-2026-66306",
"lastModified": "2026-09-16T19:24:24.507",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "secure@microsoft.com",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-66306",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:52:48.290572Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-08T19:18:08.200",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66306"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "secure@microsoft.com",
"type": "Primary"
}
]
}
} | ||||
| status | Analyzedreceipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"platforms": [
"x64-based Systems"
],
"product": "Skype for Business Server 2015 CU13",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.0.9319.885",
"status": "affected",
"version": "9319.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Skype for Business Server 2019 CU8",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.0.2046.569",
"status": "affected",
"version": "2046.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Skype for Business Server Subscription Edition CU1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.0.2046.879",
"status": "affected",
"version": "2046.0",
"versionType": "custom"
}
]
}
],
"source": "secure@microsoft.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*",
"matchCriteriaId": "590D1547-C998-4BDD-BE06-379099E2D9C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13_hotfix_2:*:*:*:*:*:*",
"matchCriteriaId": "D7B2DE75-E220-447A-90F6-D077E611945B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8:*:*:*:*:*:*",
"matchCriteriaId": "85821F4F-AC9B-4D9E-84A4-A57D842B0D5E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix1:*:*:*:*:*:*",
"matchCriteriaId": "8545EA2E-796F-4458-B996-5B907E7927EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix2:*:*:*:*:*:*",
"matchCriteriaId": "96E5BC34-2C62-4F15-AA4F-765F596C7445",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server_subscription_edition:7.0.2046.849:*:*:*:*:*:*:*",
"matchCriteriaId": "15BD78C6-A65A-4CD6-A91F-CA2876AD848C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network."
}
],
"id": "CVE-2026-66306",
"lastModified": "2026-09-16T19:24:24.507",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "secure@microsoft.com",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-66306",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:52:48.290572Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-08T19:18:08.200",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66306"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "secure@microsoft.com",
"type": "Primary"
}
]
}
} | ||||
| vendor | Microsoftreceipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"platforms": [
"x64-based Systems"
],
"product": "Skype for Business Server 2015 CU13",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.0.9319.885",
"status": "affected",
"version": "9319.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Skype for Business Server 2019 CU8",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.0.2046.569",
"status": "affected",
"version": "2046.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Skype for Business Server Subscription Edition CU1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.0.2046.879",
"status": "affected",
"version": "2046.0",
"versionType": "custom"
}
]
}
],
"source": "secure@microsoft.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*",
"matchCriteriaId": "590D1547-C998-4BDD-BE06-379099E2D9C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13_hotfix_2:*:*:*:*:*:*",
"matchCriteriaId": "D7B2DE75-E220-447A-90F6-D077E611945B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8:*:*:*:*:*:*",
"matchCriteriaId": "85821F4F-AC9B-4D9E-84A4-A57D842B0D5E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix1:*:*:*:*:*:*",
"matchCriteriaId": "8545EA2E-796F-4458-B996-5B907E7927EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_8_hotfix2:*:*:*:*:*:*",
"matchCriteriaId": "96E5BC34-2C62-4F15-AA4F-765F596C7445",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server_subscription_edition:7.0.2046.849:*:*:*:*:*:*:*",
"matchCriteriaId": "15BD78C6-A65A-4CD6-A91F-CA2876AD848C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network."
}
],
"id": "CVE-2026-66306",
"lastModified": "2026-09-16T19:24:24.507",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "secure@microsoft.com",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-66306",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:52:48.290572Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-08T19:18:08.200",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66306"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "secure@microsoft.com",
"type": "Primary"
}
]
}
} |
Text
Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.