CVE-2026-66306: CWE-209: Generation of Error Message Containing Sensitive Information in Microsoft Skype for Business Server 2015 CU13

This vulnerability (CVE-2026-66306) in Microsoft Skype for Business Server 2015 CU13 involves the generation of error messages that contain sensitive information. An unauthorized attacker can exploit this flaw to disclose sensitive data over a network. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact. Microsoft has published an official fix for this vulnerability.

The vulnerability allows an unauthorized attacker to disclose sensitive information by triggering error messages that leak such data over the network. This can lead to information disclosure that may aid further attacks or compromise confidentiality. There is no impact on integrity or availability reported. No known exploits are currently in the wild.

An official fix is available from Microsoft. Users of Skype for Business Server 2015 CU13 should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66306. Applying this update will remediate the vulnerability.