This vulnerability (CVE-2026-63523) affects Microsoft Skype for Business Server 2015 CU13 (build 9319.0). It is classified as CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting (XSS). The flaw allows an unauthorized attacker to conduct spoofing attacks over a network by injecting malicious input that is not properly sanitized when generating web pages. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is needed. The confidentiality impact is high, while integrity and availability impacts are none. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to perform spoofing attacks, potentially deceiving users by injecting malicious scripts into web pages generated by Skype for Business Server 2015 CU13. This could lead to unauthorized disclosure of information (high confidentiality impact). There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators of Skype for Business Server 2015 CU13 (build 9319.0) should apply the provided security update as soon as possible. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63523 for detailed patching instructions. No additional mitigation steps are indicated by the vendor.