CVE-2026-63523: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Microsoft Skype for Business Server 2015 CU13

This vulnerability (CVE-2026-63523) is classified as CWE-79, indicating improper neutralization of input during web page generation in Microsoft Skype for Business Server 2015 CU13. The flaw allows an attacker without privileges to conduct spoofing attacks over a network by injecting malicious input that is not properly sanitized. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity or availability impact, and official remediation is available.

An attacker can exploit this vulnerability to perform spoofing attacks, potentially misleading users by injecting malicious content into web pages generated by the affected Skype for Business Server. This can lead to unauthorized disclosure of information due to the high confidentiality impact. There is no impact on integrity or availability. The vulnerability requires user interaction and can be exploited remotely without privileges.

An official fix is available from Microsoft for this vulnerability. Users and administrators should apply the provided patch to affected versions of Skype for Business Server 2015 CU13 as soon as possible. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63523 for detailed remediation instructions.