Quick answers
- Is CVE-2026-63523 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-63523 being exploited in the wild.
- How severe is CVE-2026-63523?
- Medium severity, with a CVSS score of 6.5, published 8 September 2026.
- Which products and versions are affected?
- Microsoft Skype for Business.
- Is there a fix for CVE-2026-63523?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-63523 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-63523?
- Check whether you run Microsoft Skype for Business. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an improper neutralization of input during web page generation (CWE-79 cross-site scripting). User-supplied input is not properly sanitized before being rendered in web pages served by Skype for Business, allowing an attacker to inject arbitrary JavaScript. The attack is network-based and does not require authentication or user interaction beyond visiting a malicious link or page. An attacker can exploit this to perform spoofing, steal session tokens, redirect users to phishing sites, or manipulate displayed content. Microsoft has released a security update to remediate this issue.
Affected products
- Microsoft Skype for Business
Timeline
- 2026-09-08: disclosed