This vulnerability, identified as CVE-2026-69642, is a CWE-79 cross-site scripting issue in Microsoft Skype for Business Server 2015 CU13 (build 9319.0). It arises from improper neutralization of input during web page generation, which could enable an unauthorized attacker to conduct spoofing attacks remotely. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity. Microsoft has released an official fix for this vulnerability as detailed in their security advisory.

An attacker exploiting this vulnerability could perform spoofing attacks over a network, potentially deceiving users or systems by injecting malicious scripts into web pages generated by the affected Skype for Business Server. The impact includes limited confidentiality and integrity loss but no availability impact. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators of Skype for Business Server 2015 CU13 (build 9319.0) should apply the provided security update as soon as possible to remediate this vulnerability. Refer to the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69642 for detailed patching instructions.