This vulnerability, identified as CWE-918, affects Microsoft Skype for Business Server 2015 CU13 (build 9319.0). It allows an attacker without privileges to perform SSRF attacks, which can lead to information disclosure by making the server send crafted requests to internal or external resources. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Microsoft has published an official fix for this vulnerability, as detailed in their security update guide.

An attacker can exploit this SSRF vulnerability to disclose sensitive information over the network without requiring authentication or user interaction. The impact is limited to confidentiality, with no integrity or availability impact reported. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users of Skype for Business Server 2015 CU13 (build 9319.0) should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66304 to remediate this vulnerability.