Microsoft rates CVE-2026-66304 at CVSS 7.5, with a temporal score of 6.5. The advisory’s CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C, describing a network-reachable issue with low attack complexity that requires neither privileges nor user interaction. The score’s impact is confined to confidentiality: high confidentiality impact, with no integrity or availability impact listed.
Microsoft published the advisory on September 8, 2026. The company’s assessment is Exploitation Less Likely, but the remediation is still an administrative priority because an unauthenticated, network-based route to information disclosure can be particularly consequential on a communications server connected to internal services.
The SSRF condition behind CVE-2026-66304
Microsoft describes CVE-2026-66304 as “Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.” The assigned weakness category is CWE-918, the Common Weakness Enumeration entry for server-side request forgery.
SSRF occurs when an attacker can induce a server to make a request chosen or influenced by the attacker. Rather than connecting directly to an internal endpoint from outside the organization, the attacker attempts to make the vulnerable service perform that connection. This can matter where the service has network access that an external attacker does not, including access to internal web services, management endpoints, or other resources reachable from the Skype for Business Server environment.
Microsoft’s advisory gives a concise exploitation condition: “An attacker would have to make the service attempt to connect to the malicious server, leading to a Server-side request forgery.” The record does not describe a user-driven attack path, which aligns with the UI:N value in the published CVSS vector. It also does not identify a data type that could be exposed, a particular service endpoint, or a configuration prerequisite beyond the affected server products and cumulative-update baselines.
The key operational point is that this is a server-side flaw. Endpoint patching, user education, and client updates do not replace updating the Skype for Business Server installation itself.
Microsoft’s severity and status fields
Microsoft classifies CVE-2026-66304 as Important, rather than Critical, despite its 7.5 base score. The supplied scoring data limits the impact to information disclosure: the vector assigns C:H, I:N, and A:N. In practical terms, the published assessment concerns exposure of information through a server-originated request, rather than an advisory claiming code execution, modification of data, or service disruption.
The advisory’s status fields are explicit:
- Publicly disclosed: No.
- Exploited: No.
- Customer action required: Yes.
Microsoft’s exploitation assessment is “Exploitation Less Likely.” That assessment should be treated as prioritization input, not as a substitute for patch deployment. A low-likelihood assessment does not change the CVSS prerequisites: network access, low attack complexity, no required privileges, and no user interaction.
The temporal score of 6.5 reflects the version of the advisory data supplied with this release. For patch managers, the more actionable combination is the vendor’s status: Microsoft says customers need to act, and it provides fixed builds for each supported affected product named in the advisory.
KB5123301, KB5123300, and KB5123287 map to different server releases
The affected products are distinct Skype for Business Server release branches, and the KB package must match the installed product and cumulative update level. Administrators should not treat the three updates as interchangeable merely because they address the same CVE.
For Skype for Business Server 2015 CU13 (x64), install KB5123301 to reach fixed build 6.0.9319.885.
For Skype for Business Server 2019 CU8 (x64), install KB5123300 to reach fixed build 7.0.2046.569.
For Skype for Business Server Subscription Edition CU1 (x64), install KB5123287 to reach fixed build 7.0.2046.879.
Those fixed build numbers provide the useful verification point after maintenance: a successful download or installation attempt alone is weaker evidence than confirming that the affected server has reached Microsoft’s specified build. The build mapping also makes clear that the mitigation path is a server update for each product branch, rather than a shared client package.
What administrators should verify before closing the change
Organizations with Skype for Business Server infrastructure should identify servers running the three affected product baselines listed by Microsoft, match each installation to its designated KB, and verify the resulting build. Because the vulnerability is categorized as SSRF and described as network-reachable, patching should include systems that may not be used daily but still expose Skype for Business services or retain connectivity to internal resources.
The change record should preserve the installed KB and resulting build:
- Skype for Business Server 2015 CU13 (x64) is remediated by KB5123301 at build 6.0.9319.885.
- Skype for Business Server 2019 CU8 (x64) is remediated by KB5123300 at build 7.0.2046.569.
- Skype for Business Server Subscription Edition CU1 (x64) is remediated by KB5123287 at build 7.0.2046.879.
Microsoft’s advisory does not present a workaround in the supplied record. The documented remedy is installation of the corresponding KB to reach the listed fixed version. For environments subject to staged change control, the explicit build target gives operations teams a post-deployment condition to test and security teams a concrete compliance check to request.
The practical consequence for Skype for Business Server estates
CVE-2026-66304 is narrowly described as an information-disclosure vulnerability, but the SSRF mechanism is relevant to how administrators assess servers in their network. The service’s ability to make connections is the feature an attacker would seek to misuse; therefore, a Skype for Business Server’s internal reachability is part of the risk picture, alongside its externally accessible interfaces.
Microsoft does not claim integrity or availability effects for this CVE, and the advisory does not supply technical exploit details beyond the requirement to make the service attempt a connection to a malicious server. The evidence supports patching the named products and checking their resulting builds; it does not support assuming broader effects than the advisory identifies.
For affected deployments, the concrete next step is to install KB5123301, KB5123300, or KB5123287 as appropriate and verify build 6.0.9319.885, 7.0.2046.569, or 7.0.2046.879 before marking CVE-2026-66304 remediated.