CVE-2026-69646CWE-347

CVE-2026-69646

High · published September 8, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
23.8
In the wild
Unconfirmed
What it is

Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00320 · 23.8th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-09-08T23:19Z
Affected products (6)
ProductVersionsFixed in
microsoft/skype_for_business_serverall versions—
microsoft/skype_for_business_serverall versions—
microsoft/skype_for_business_serverall versions—
microsoft/skype_for_business_serverall versions—
microsoft/skype_for_business_serverall versions—
microsoft/skype_for_business_server_subscription_editionall versions—
References (1)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69646 · [email protected]
EPSS history
Timeline
  • 10 SEP 03:17Z
    EPSS moved — → 0%
    epss
  • 08 SEP 18:33Z
    Skype for Business Spoofing Vulnerability
    cvelistv5