Microsoft’s advisory describes a network-reachable issue in which generation of an error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network. The advisory’s most consequential detail is specific: successful exploitation could disclose credentials. Microsoft assigns the vulnerability a CVSS base score of 6.5 and says customer action is required.
Publicly disclosed: No
Exploited: No
Customer action required: Yes
CVE-2026-66306 affects Skype for Business Server error handling
CVE-2026-66306 is classified as Important and tracks CWE-209, Generation of Error Message Containing Sensitive Information. Microsoft’s full title is “Skype for Business Information Disclosure Vulnerability.”
The weakness concerns what the server may reveal when handling an error condition. Information-disclosure flaws can be operationally easy to underestimate because they do not alter data or stop a service; here, Microsoft explicitly says the information that could be disclosed includes credentials. For organizations that retain Skype for Business Server for internal communications, federation, or line-of-business integrations, credential exposure can create a broader access-management problem than the initial error response suggests.
Microsoft’s description says: “Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.” The published CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C.
That vector records network attack access, low attack complexity, no privileges required, and required user interaction. It also scores confidentiality as High, while integrity and availability are unaffected. The base score is 6.5; Microsoft’s temporal score is 5.7. Microsoft’s exploitation assessment is “Exploitation Less Likely.”
Three server release branches have separate fixed builds
Microsoft lists three affected 64-bit Skype for Business Server products, each with a different KB package and final fixed build. The practical deployment risk is selecting an update based on the server family name alone: Skype for Business Server 2015, Skype for Business Server 2019, and Skype for Business Server Subscription Edition CU1 do not use the same KB or build target.
| Affected product | Required update | Fixed build |
|---|---|---|
| Skype for Business Server 2015 CU13 (x64) | KB5123301 | 6.0.9319.885 |
| Skype for Business Server 2019 CU8 (x64) | KB5123300 | 7.0.2046.569 |
| Skype for Business Server Subscription Edition CU1 (x64) | KB5123287 | 7.0.2046.879 |
The remediation values Microsoft provides are explicit:
- For Skype for Business Server 2015 CU13 (x64), install KB5123301 to reach fixed build 6.0.9319.885.
- For Skype for Business Server 2019 CU8 (x64), install KB5123300 to reach fixed build 7.0.2046.569.
- For Skype for Business Server Subscription Edition CU1 (x64), install KB5123287 to reach fixed build 7.0.2046.879.
The build numbers are an important validation point for change-control teams. Recording only that a KB was approved or scheduled does not establish that a particular Skype for Business Server installation has reached Microsoft’s stated remediated level. Administrators should use the applicable KB and verify the resulting build against the fixed-build target for that exact product branch.
Credential disclosure changes the patching priority
Microsoft has not characterized CVE-2026-66306 as publicly disclosed or exploited, and its assessment is “Exploitation Less Likely.” Those are useful prioritization signals, but they do not reduce the vendor’s instruction that customer action is required.
The vulnerability’s confidentiality impact deserves attention in environments where Skype for Business Server remains connected to identity-sensitive services and workflows. The advisory does not describe an integrity or availability effect; its stated risk is disclosure, with credentials named as the information potentially exposed. Security teams should therefore treat installation as the primary remediation and incorporate the resulting server build into their vulnerability-management evidence.
This is also a case where the affected-product labels matter. The fixed target for Skype for Business Server 2015 CU13 (x64) is 6.0.9319.885, while the two 7.0.2046 branches require different destination builds: 7.0.2046.569 for Skype for Business Server 2019 CU8 (x64) and 7.0.2046.879 for Skype for Business Server Subscription Edition CU1 (x64). A 7.0.2046 build number by itself is insufficient evidence of remediation without matching it to the correct server release and KB.
What administrators should document
For affected deployments, the immediate operational task is narrow: identify the installed Skype for Business Server release, apply its corresponding KB, and verify the stated fixed build. Microsoft’s advisory supports no substitute remediation in the supplied record.
Administrators should retain the product name, KB number, and observed post-update build in patch records:
- Skype for Business Server 2015 CU13 (x64) is remediated by KB5123301 at build 6.0.9319.885.
- Skype for Business Server 2019 CU8 (x64) is remediated by KB5123300 at build 7.0.2046.569.
- Skype for Business Server Subscription Edition CU1 (x64) is remediated by KB5123287 at build 7.0.2046.879.
CVE-2026-66306’s remediation is therefore concrete: apply the KB matched to the deployed Skype for Business Server branch and verify the corresponding fixed version.